diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-12-20 14:22:11 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-12-20 14:22:11 +0000 |
| commit | 0c872e02b2c822e3397515ec324051ff540f0cd5 (patch) | |
| tree | ce2fb6ce7030e4dad0f4118d21ab6453e5938cdd /lib/api/markdown.rb | |
| parent | f7e05a6853b12f02911494c4b3fe53d9540d74fc (diff) | |
| download | gitlab-ce-15.7.0-rc42.tar.gz | |
Add latest changes from gitlab-org/gitlab@15-7-stable-eev15.7.0-rc42
Diffstat (limited to 'lib/api/markdown.rb')
| -rw-r--r-- | lib/api/markdown.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/api/markdown.rb b/lib/api/markdown.rb index 276560f3433..f348e20cc0b 100644 --- a/lib/api/markdown.rb +++ b/lib/api/markdown.rb @@ -35,6 +35,11 @@ module API context[:skip_project_check] = true end + # Disable comments in markdown for IE browsers because comments in IE + # could allow script execution. + browser = Browser.new(headers['User-Agent']) + context[:allow_comments] = !browser.ie? + present({ html: Banzai.render_and_post_process(params[:text], context) }, with: Entities::Markdown) end end |