diff options
| author | Stan Hu <stanhu@gmail.com> | 2015-09-12 20:54:06 -0700 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2016-02-01 18:25:32 +0100 |
| commit | f86ddfd36538667cd0c484a62825569a36ef2a2c (patch) | |
| tree | c8d68ea4b84324f974db7671ccba13b754ad4b6f /app | |
| parent | da8e0f86595299740a344309cb5963854b61c4a6 (diff) | |
| download | gitlab-ce-f86ddfd36538667cd0c484a62825569a36ef2a2c.tar.gz | |
Render sanitized SVG images
Closes https://github.com/gitlabhq/gitlabhq/issues/9265
Diffstat (limited to 'app')
| -rw-r--r-- | app/helpers/blob_helper.rb | 12 | ||||
| -rw-r--r-- | app/views/projects/blob/_blob.html.haml | 5 |
2 files changed, 16 insertions, 1 deletions
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb index 694c03206bd..16967927922 100644 --- a/app/helpers/blob_helper.rb +++ b/app/helpers/blob_helper.rb @@ -126,4 +126,16 @@ module BlobHelper blob.size end end + + def blob_svg?(blob) + blob.language && blob.language.name == 'SVG' + end + + # SVGs can contain malicious JavaScript; only include whitelisted + # elements and attributes. Note that this whitelist is by no means complete + # and may omit some elements. + def sanitize_svg(blob) + blob.data = Loofah.scrub_fragment(blob.data, :strip).to_xml + blob + end end diff --git a/app/views/projects/blob/_blob.html.haml b/app/views/projects/blob/_blob.html.haml index 3d8d88834e2..2c5b8dc4356 100644 --- a/app/views/projects/blob/_blob.html.haml +++ b/app/views/projects/blob/_blob.html.haml @@ -35,7 +35,10 @@ - if blob.lfs_pointer? = render "download", blob: blob - elsif blob.text? - = render "text", blob: blob + - if blob_svg?(blob) + = render "image", blob: sanitize_svg(blob) + - else + = render "text", blob: blob - elsif blob.image? = render "image", blob: blob - else |