summaryrefslogtreecommitdiff
path: root/lib/banzai
Commit message (Collapse)AuthorAgeFilesLines
* Allow emoji in label and milestone referencesallow-emoji-in-referencesSean McGivern2019-06-071-1/+1
| | | | | | | | | | | | | | | If we put the emoji filter before the reference filters, each emoji will have a wrapper element that prevents the reference filter from detecting the presence of the emoji. As the emoji filter now runs after the reference filters, references must contain a literal emoji, not the GitLab Flavored Markdown versions (:100`, for example). A weird side-effect is that if you have a label with the 100 emoji, and a label named :100:, then trying to reference the latter will work (link to the correct label), but will render with the 100 emoji. I'm comfortable with that edge case, I think.
* Use Redis for CacheMarkDownField on non AR modelsPatrick Bajao2019-06-051-1/+1
| | | | | | | | | | | | | | | | | | This allows using `CacheMarkdownField` for models that are not backed by ActiveRecord. When the including class inherits `ActiveRecord::Base` we include `Gitlab::MarkdownCache::ActiveRecord::Extension`. This will cause the markdown fields to be rendered and the generated HTML stored in a `<field>_html` attribute on the record. We also store the version used for generating the markdown. All other classes that include this model will include the `Gitlab::MarkdownCache::Redis::Extension`. This add the `<field>_html` attributes to that model and will generate the html in them. The generated HTML will be cached in redis under the key `markdown_cache:<class>:<id>`. The class this included in must therefore respond to `id`.
* Merge branch 'security-60143-address-xss-issue-master' into 'master'Robert Speicher2019-06-031-0/+8
|\ | | | | | | | | Reject slug+uri concat if slug is deemed unsafe See merge request gitlab/gitlabhq!3108
| * Reject slug+uri concat if slug is deemed unsafeKerri Miller2019-05-241-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First reported: https://gitlab.com/gitlab-org/gitlab-ce/issues/60143 When the page slug is "javascript:" and we attempt to link to a relative path (using `.` or `..`) the code will concatenate the slug and the uri. This MR adds a guard to that concat step that will return `nil` if the incoming slug matches against any of the "unsafe" slug regexes; currently this is only for the slug "javascript:" but can be extended if needed. Manually tested against a non-exhaustive list from OWASP of common javascript XSS exploits that have to to with mangling the "javascript:" method, and all are caught by this change or by existing code that ingests the user-specified slug.
* | Merge branch 'security-fix-project-existence-disclosure-master' into 'master'GitLab Release Tools Bot2019-06-031-2/+5
|\ \ | |/ |/| | | | | Fix url redaction for issue links See merge request gitlab/gitlabhq!3091
| * Fix url redaction for issue linksPatrick Derichs2019-05-031-2/+5
| | | | | | | | | | | | | | | | | | | | Add changelog entry Add missing href to all redactor specs and removed href assignment Remove obsolete spec If original_content is given, it should be used for link content
* | Fix milestone references with HTML entities in the namefix-milestone-references-with-escaped-html-entitiesSean McGivern2019-05-243-10/+10
| | | | | | | | | | | | | | | | | | When a milestone name contained an HTML entity that would be escaped (&, <, >), then it wasn't possible to refer to this milestone by name, or use it in a quick action. This already worked for labels, but not for milestones. We take care to re-escape un-matched milestones, too.
* | Merge branch 'patch-49' into 'master'Sean McGivern2019-05-061-0/+1
|\ \ | | | | | | | | | | | | | | | | | | No leading/trailing spaces when generating heading ids (Fixes #57528) Closes #57528 See merge request gitlab-org/gitlab-ce!27025
| * | Use strip to remove leading/trailing spacesWillian Balmant2019-04-111-2/+1
| | | | | | | | | Change based on comments in MR #27025
| * | No leading/trailing spaces when generating heading ids (Fixes #57528)Willian Balmant2019-04-101-2/+2
| | | | | | | | | Update based on comments in MR #27025
| * | No leading/trailing spaces when generating heading ids (Fixes #57528)Willian Balmant2019-04-041-0/+2
| | |
* | | Run rubocop -a on CE filessh-upgrade-rubocop-0.68.0-ceStan Hu2019-05-055-14/+14
| |/ |/|
* | Move scoped_label into label presenterJan Provaznik2019-04-231-2/+4
| | | | | | | | | | | | | | When rendering a label we want to check 'scoped_label' feature availability on a project/group where label is being used. For this reason a label presenter is used in UI and information about context project/group is passed to this presenter.
* | Remove multi-line suggestions feature flagosw-remote-multi-line-suggestions-ffOswaldo Ferreira2019-04-101-12/+0
| | | | | | | | That's a straightforward feature flag code removal for 11.10
* | Merge branch 'docs-zj-update-n-plus-one-comments' into 'master'Douglas Barbosa Alexandre2019-04-091-1/+1
|\ \ | | | | | | | | | | | | Update comments about N + 1 Gitaly calls See merge request gitlab-org/gitlab-ce!27178
| * | Update comments about N + 1 Gitaly callsZeger-Jan van de Weg2019-04-091-1/+1
| | | | | | | | | | | | | | | To make sure all known issues are linked to the correct epic, I've gone through the code base, and updated the comments where required.
* | | [CE] Support multiple assignees for merge requestsosw-multi-assignees-merge-requestsOswaldo Ferreira2019-04-081-1/+1
|/ / | | | | | | | | Backports https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10161 (code out of ee/ folder).
* | Merge branch 'keyval-labels' into 'master'Sean McGivern2019-04-052-4/+14
|\ \ | | | | | | | | | | | | [CE] Add mutually exclusive labels See merge request gitlab-org/gitlab-ce!26804
| * | [backend] backport of scoped labelsJan Provaznik2019-04-042-4/+14
| | | | | | | | | | | | Scoped labels in EE require additional changes in CE code.
* | | Fenced blockquotes to not change source line pos58717-checkbox-cannot-be-checked-if-a-blockquote-is-aboveBrett Walker2019-04-041-1/+3
| |/ |/| | | | | | | Replaces blockquote fences with \n, keeping the line numbering intact.
* | Fixed test specsOswaldo Ferreira2019-04-041-16/+0
|/ | | | | - added suggestions to mock data - fixed props to be not required
* Prepare suggestion implementation for multi-lineOswaldo Ferreira2019-03-271-0/+2
| | | | | | Adds the groundwork needed in order to persist multi-line suggestions, while providing the parsing strategy which will be reused for the **Preview** as well.
* Merge branch '54916-extended-tooltip-for-merge-request-links' into 'master'Phil Hughes2019-03-262-6/+17
|\ | | | | | | | | | | | | Resolve "Extended tooltip for merge request links" Closes #54916 See merge request gitlab-org/gitlab-ce!25221
| * Add merge request popover with detailsSam Bigelow2019-03-212-6/+17
| | | | | | | | | | | | | | | | | | - Show pipeline status, title, MR Status and project path - Popover attached to gitlab flavored markdown everywhere, including: + MR/Issue Title + MR/Issue description + MR/Issue comments + Rendered markdown files
* | Implement multi-line suggestions filteringOswaldo Ferreira2019-03-204-6/+49
|/ | | | | Implements the filtering logic for `suggestion:-x+y` syntax.
* Add SyntaxHighlightFilter to markup pipelineMartin Wortschack2019-03-051-1/+2
|
* Only allow 30 RPCs per test case to GitalyZeger-Jan van de Weg2019-02-221-1/+4
| | | | | | | | | Prior to this change, 35 Gitaly RPCs were allowed. But recently there's been a renewed interest in performance. By lowering the number of calls new N + 1's will pop up. Later commits will add blocks to ignore the raised errors, followed by an issue for each to be fixed.
* Properly handle multiple refs to same footnoteBrett Walker2019-02-131-7/+16
|
* Merge branch 'jprovazn-remove-redcarpet' into 'master'Grzegorz Bizon2019-02-054-54/+0
|\ | | | | | | | | | | | | Remove Redcarpet markdown engine Closes #51374 See merge request gitlab-org/gitlab-ce!24819
| * Remove Redcarpet markdown engineJan Provaznik2019-02-044-54/+0
| | | | | | | | | | This engine was replaced with CommonMarker in 11.4, it was deprecated since then.
* | Catch possible Addressable::URI::InvalidURIErrorBrett Walker2019-02-041-1/+5
|/
* Show tooltip for malicious looking linksBrett Walker2019-01-313-11/+88
| | | | | | | Such as those with IDN homographs or embedded right-to-left (RTLO) characters. Autolinked hrefs should be escaped
* Merge branch 'bw-enable-sourcepos' into 'master'Robert Speicher2019-01-289-7/+36
|\ | | | | | | | | Enable CommonMark source line position information See merge request gitlab-org/gitlab-ce!23971
| * Fix review commentsBrett Walker2019-01-215-3/+17
| | | | | | | | | | | | including refactoring, disabling sourcepos for pipelines that don't need it, and minimizing spec changes by disabling sourcepos when not testing for it explicitly.
| * Enable CommonMark source line position informationBrett Walker2019-01-216-6/+21
| | | | | | | | | | | | This adds 'data-sourcepos' to tags, indicating which line of markdown it came from. Sets the stage for intelligently manipulating specific lines of markdown.
* | Allow suggestions to be copied and pasted as GFMDouwe Maan2019-01-251-0/+1
| | | | | | | | | | Supports both suggestions transformed from GFM to HTML and from GFM to HTML to Vue component.
* | Merge branch 'db-copy-as-gfm-prosemirror' into 'master'Phil Hughes2019-01-2512-5/+21
|\ \ | | | | | | | | | | | | Reimplement Copy-as-GFM using the prosemirror document model See merge request gitlab-org/gitlab-ce!22797
| * | Use nodes and marks to power Copy-as-GFMdb-copy-as-gfm-prosemirrorDouwe Maan2019-01-2412-5/+21
| |/ | | | | | | | | The spec needed to be updated because in some cases the resulting Markdown is slightly different, though equally valid.
* | Fix 404s for snippet uploads when relative URL root usedStan Hu2019-01-221-0/+2
|/ | | | | | | | | Personal snippet uploads have neither a group nor a project. If a GitLab instance were configured with a relative URL root (e.g. `/gitlab`), then the Markdown filter would not include this root in the generated path. We fix this by adding this root if there is no group or project. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56280
* Merge branch '26375-markdown-footnotes-not-working' into 'master'Lin Jen-Shin2019-01-173-5/+93
|\ | | | | | | | | | | | | Markdown footnotes not working Closes #26375 See merge request gitlab-org/gitlab-ce!24168
| * Refactoring and addressing review commentsBrett Walker2019-01-172-16/+25
| | | | | | | | and additional spec
| * Updates based on review commentsBrett Walker2019-01-102-9/+9
| |
| * Properly process footnotes in markdownBrett Walker2019-01-083-2/+81
| | | | | | | | | | All the ids and classes were stripped. Add them back in and make ids unique
* | Fix MilestonesFinder to pass relations to scopeHeinrich Lee Yu2019-01-121-2/+2
|/ | | | | | | Instead of querying relations into ids we just pass them to the model scope because the scope supports it now. Also changes other calls to `Milestone.for_projects_and_groups`
* Merge branch 'security-label-xss' into 'master'John Jarvis2019-01-021-1/+5
|\ | | | | | | | | [master] Escape html entities when no label found See merge request gitlab/gitlabhq!2706
| * Escape html entities when no label foundJarka Košanová2018-12-121-1/+5
| |
* | Merge branch 'security-master-url-rel' into 'master'John Jarvis2019-01-021-6/+6
|\ \ | | | | | | | | | | | | [master] Set URL rel attribute for broken URLs See merge request gitlab/gitlabhq!2695
| * | Set URL rel attribute for broken URLsJan Provaznik2018-12-111-6/+6
| |/ | | | | | | | | | | It's possible that URI fails to parse a link, but browsers still recognize given URL as a link, we should make sure that 'rel' attribute is set also in this case.
* | Remove feature flag for suggest changes featureOswaldo Ferreira2018-12-181-1/+0
| |
* | Allow suggesting single line changes in diffsOswaldo Ferreira2018-12-135-2/+43
|/
View Lorry Controller Status