diff options
author | Gabriel Mazetto <gabriel@gitlab.com> | 2016-06-02 00:37:25 -0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2016-06-12 21:05:57 -0400 |
commit | 02b882418a44bccbcde403886c560505abd60281 (patch) | |
tree | b1d756f5f38b94682742c73ecb621f354ca40c83 /lib/gitlab/sanitizers | |
parent | 8d243f9bdacea1909bf503eb715bd437c3b48aa7 (diff) | |
download | gitlab-ce-02b882418a44bccbcde403886c560505abd60281.tar.gz |
Fix SVG whitelisting to allow namespaced attributes
Diffstat (limited to 'lib/gitlab/sanitizers')
-rw-r--r-- | lib/gitlab/sanitizers/svg.rb | 23 |
1 files changed, 18 insertions, 5 deletions
diff --git a/lib/gitlab/sanitizers/svg.rb b/lib/gitlab/sanitizers/svg.rb index 5e95f6c0529..a540c534dee 100644 --- a/lib/gitlab/sanitizers/svg.rb +++ b/lib/gitlab/sanitizers/svg.rb @@ -13,12 +13,11 @@ module Gitlab unless Whitelist::ALLOWED_ELEMENTS.include?(node.name) node.unlink else - node.attributes.each do |attr_name, attr| - valid_attributes = Whitelist::ALLOWED_ATTRIBUTES[node.name] + valid_attributes = Whitelist::ALLOWED_ATTRIBUTES[node.name] - unless valid_attributes && valid_attributes.include?(attr_name) - if Whitelist::ALLOWED_DATA_ATTRIBUTES_IN_ELEMENTS.include?(node.name) && - attr_name.start_with?('data-') + node.attribute_nodes.each do |attr| + unless valid_attributes && valid_attributes.include?(attribute_name_with_namespace(attr)) + if Whitelist::ALLOWED_DATA_ATTRIBUTES_IN_ELEMENTS.include?(node.name) && data_attribute?(attr) # Arbitrary data attributes are allowed. Verify that the attribute # is a valid data attribute. attr.unlink unless attr_name =~ DATA_ATTR_PATTERN @@ -29,6 +28,20 @@ module Gitlab end end end + + def attribute_name_with_namespace(attr) + if attr.namespace + "#{attr.namespace.prefix}:#{attr.name}" + else + attr.name + end + end + + private + + def data_attribute?(attr) + attr.name.start_with?('data-') + end end end end |