diff options
author | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2021-03-17 14:00:36 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2021-03-17 14:00:36 +0000 |
commit | 20a8572d20a41d748bcfa065d5ffbf46f0d31282 (patch) | |
tree | 35003adcbc4c8a941dbff73bbae2e4b0fccc8044 | |
parent | 9b43731381f9fb7d86726468e76f8c7087275e37 (diff) | |
parent | 4469fca16f1680fe40a4e1ada8b75550af469c44 (diff) | |
download | gitlab-ce-20a8572d20a41d748bcfa065d5ffbf46f0d31282.tar.gz |
Merge remote-tracking branch 'dev/13-8-stable' into 13-8-stable
-rw-r--r-- | CHANGELOG.md | 7 | ||||
-rw-r--r-- | GITALY_SERVER_VERSION | 2 | ||||
-rw-r--r-- | VERSION | 2 | ||||
-rw-r--r-- | config/initializers/kramdown_patch.rb | 25 | ||||
-rw-r--r-- | spec/initializers/kramdown_patch_spec.rb | 38 |
5 files changed, 72 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 866522303f7..b91975e492a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 13.8.6 (2021-03-17) + +### Security (1 change) + +- Patch Kramdown syntax highlighter gem. + + ## 13.8.5 (2021-03-04) ### Security (6 changes) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 16b3c156a4e..fb2ae584957 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -13.8.5
\ No newline at end of file +13.8.6
\ No newline at end of file @@ -1 +1 @@ -13.8.5
\ No newline at end of file +13.8.6
\ No newline at end of file diff --git a/config/initializers/kramdown_patch.rb b/config/initializers/kramdown_patch.rb new file mode 100644 index 00000000000..5cb769cec24 --- /dev/null +++ b/config/initializers/kramdown_patch.rb @@ -0,0 +1,25 @@ +# frozen_string_literal: true +# +# This pulls in https://github.com/gettalong/kramdown/pull/708 for kramdown v2.3.0. +# Remove this file when that pull request is merged and released. +require 'kramdown/converter' +require 'kramdown/converter/syntax_highlighter/rouge' + +module Kramdown::Converter::SyntaxHighlighter + module Rouge + def self.formatter_class(opts = {}) + case formatter = opts[:formatter] + when Class + formatter + when /\A[[:upper:]][[:alnum:]_]*\z/ + ::Rouge::Formatters.const_get(formatter, false) + else + # Available in Rouge 2.0 or later + ::Rouge::Formatters::HTMLLegacy + end + rescue NameError + # Fallback to Rouge 1.x + ::Rouge::Formatters::HTML + end + end +end diff --git a/spec/initializers/kramdown_patch_spec.rb b/spec/initializers/kramdown_patch_spec.rb new file mode 100644 index 00000000000..49dda9252bb --- /dev/null +++ b/spec/initializers/kramdown_patch_spec.rb @@ -0,0 +1,38 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Kramdown patch for syntax highlighting formatters' do + subject { Kramdown::Document.new(options + "\n" + code).to_html } + + let(:code) do + <<-RUBY +~~~ ruby + def what? + 42 + end +~~~ + RUBY + end + + context 'with invalid formatter' do + let(:options) { %({::options auto_ids="false" footnote_nr="5" syntax_highlighter="rouge" syntax_highlighter_opts="{formatter: CSV, line_numbers: true\\}" /}) } + + it 'falls back to standard HTML and disallows CSV' do + expect(CSV).not_to receive(:new) + expect(::Rouge::Formatters::HTML).to receive(:new).and_call_original + + expect(subject).to be_present + end + end + + context 'with valid formatter' do + let(:options) { %({::options auto_ids="false" footnote_nr="5" syntax_highlighter="rouge" syntax_highlighter_opts="{formatter: HTMLLegacy\\}" /}) } + + it 'allows formatter' do + expect(::Rouge::Formatters::HTMLLegacy).to receive(:new).and_call_original + + expect(subject).to be_present + end + end +end |