diff options
author | Douwe Maan <douwe@gitlab.com> | 2017-09-25 07:49:43 +0000 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2017-09-25 07:49:43 +0000 |
commit | a183b529dc2a1b9345ec594578d1d54b777f9365 (patch) | |
tree | 8f8784d141384d0852c8255dfac1ad3cec3bb895 | |
parent | 26f05621248c6155af196794239d80117f915a0c (diff) | |
parent | f6bc4403d2f83e5571a06af3ad0989422bf23c12 (diff) | |
download | gitlab-ce-a183b529dc2a1b9345ec594578d1d54b777f9365.tar.gz |
Merge branch 'rs-allow-name-on-anchors' into 'master'
Re-allow `name` attribute on user-provided anchor HTML
Closes #38196
See merge request gitlab-org/gitlab-ce!14452
-rw-r--r-- | changelogs/unreleased/rs-allow-name-on-anchors.yml | 5 | ||||
-rw-r--r-- | lib/banzai/filter/sanitization_filter.rb | 3 | ||||
-rw-r--r-- | spec/lib/banzai/filter/sanitization_filter_spec.rb | 8 |
3 files changed, 13 insertions, 3 deletions
diff --git a/changelogs/unreleased/rs-allow-name-on-anchors.yml b/changelogs/unreleased/rs-allow-name-on-anchors.yml new file mode 100644 index 00000000000..59e95ed8a0e --- /dev/null +++ b/changelogs/unreleased/rs-allow-name-on-anchors.yml @@ -0,0 +1,5 @@ +--- +title: Re-allow `name` attribute on user-provided anchor HTML +merge_request: +author: +type: fixed diff --git a/lib/banzai/filter/sanitization_filter.rb b/lib/banzai/filter/sanitization_filter.rb index 9923ec4e870..88b17e12576 100644 --- a/lib/banzai/filter/sanitization_filter.rb +++ b/lib/banzai/filter/sanitization_filter.rb @@ -45,8 +45,9 @@ module Banzai whitelist[:elements].push('abbr') whitelist[:attributes]['abbr'] = %w(title) - # Disallow `name` attribute globally + # Disallow `name` attribute globally, allow on `a` whitelist[:attributes][:all].delete('name') + whitelist[:attributes]['a'].push('name') # Allow any protocol in `a` elements... whitelist[:protocols].delete('a') diff --git a/spec/lib/banzai/filter/sanitization_filter_spec.rb b/spec/lib/banzai/filter/sanitization_filter_spec.rb index 01ceb21dfaa..5f41e28fece 100644 --- a/spec/lib/banzai/filter/sanitization_filter_spec.rb +++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb @@ -47,9 +47,11 @@ describe Banzai::Filter::SanitizationFilter do describe 'custom whitelist' do it 'customizes the whitelist only once' do instance = described_class.new('Foo') + control_count = instance.whitelist[:transformers].size + 3.times { instance.whitelist } - expect(instance.whitelist[:transformers].size).to eq 5 + expect(instance.whitelist[:transformers].size).to eq control_count end it 'sanitizes `class` attribute from all elements' do @@ -101,16 +103,18 @@ describe Banzai::Filter::SanitizationFilter do expect(filter(act).to_html).to eq exp end - it 'disallows the `name` attribute globally' do + it 'disallows the `name` attribute globally, allows on `a`' do html = <<~HTML <img name="getElementById" src=""> <span name="foo" class="bar">Hi</span> + <a name="foo" class="bar">Bye</a> HTML doc = filter(html) expect(doc.at_css('img')).not_to have_attribute('name') expect(doc.at_css('span')).not_to have_attribute('name') + expect(doc.at_css('a')).to have_attribute('name') end it 'allows `summary` elements' do |