summaryrefslogtreecommitdiff
path: root/lib/banzai
diff options
context:
space:
mode:
authorDouwe Maan <douwe@gitlab.com>2018-01-31 21:48:18 +0000
committerRobert Speicher <rspeicher@gmail.com>2018-02-09 12:13:44 -0600
commit603fa7c14193d37e3953225501d2108f0c581df5 (patch)
treebbaa12a41c577dbcb7e4cd1772df7fd2f2156d8e /lib/banzai
parent5e9e56924a56dcb84c3ae4ae6fc308f635f39f66 (diff)
downloadgitlab-ce-603fa7c14193d37e3953225501d2108f0c581df5.tar.gz
Merge branch 'fix-mermaid-xss' into 'security-10-4'
[10.4] Fix stored XSS in code blocks
Diffstat (limited to 'lib/banzai')
-rw-r--r--lib/banzai/filter/syntax_highlight_filter.rb34
1 files changed, 22 insertions, 12 deletions
diff --git a/lib/banzai/filter/syntax_highlight_filter.rb b/lib/banzai/filter/syntax_highlight_filter.rb
index a79a0154846..0ac7e231b5b 100644
--- a/lib/banzai/filter/syntax_highlight_filter.rb
+++ b/lib/banzai/filter/syntax_highlight_filter.rb
@@ -14,23 +14,33 @@ module Banzai
end
def highlight_node(node)
- code = node.text
css_classes = 'code highlight js-syntax-highlight'
- language = node.attr('lang')
+ lang = node.attr('lang')
+ retried = false
- if use_rouge?(language)
- lexer = lexer_for(language)
+ if use_rouge?(lang)
+ lexer = lexer_for(lang)
language = lexer.tag
+ else
+ lexer = Rouge::Lexers::PlainText.new
+ language = lang
+ end
+
+ begin
+ code = Rouge::Formatters::HTMLGitlab.format(lex(lexer, node.text), tag: language)
+ css_classes << " #{language}" if language
+ rescue
+ # Gracefully handle syntax highlighter bugs/errors to ensure users can
+ # still access an issue/comment/etc. First, retry with the plain text
+ # filter. If that fails, then just skip this entirely, but that would
+ # be a pretty bad upstream bug.
+ return if retried
- begin
- code = Rouge::Formatters::HTMLGitlab.format(lex(lexer, code), tag: language)
- css_classes << " #{language}"
- rescue
- # Gracefully handle syntax highlighter bugs/errors to ensure
- # users can still access an issue/comment/etc.
+ language = nil
+ lexer = Rouge::Lexers::PlainText.new
+ retried = true
- language = nil
- end
+ retry
end
highlighted = %(<pre class="#{css_classes}" lang="#{language}" v-pre="true"><code>#{code}</code></pre>)