From a7afc0634240f5cddb6c6e1bf1f9fcf4374b852e Mon Sep 17 00:00:00 2001
From: Vinnie Okada <vokada@mrvinn.com>
Date: Sun, 22 Mar 2015 09:02:32 -0600
Subject: Fix SanitizationFilter bugs

Return a `SafeBuffer` instead of a `String` from the `#gfm_with_options`
method so that Rails doesn't escape our markup.

Also add `<span>` to the sanitization whitelist to avoid breaking syntax
highlighting in code blocks.
---
 lib/gitlab/markdown.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/markdown.rb b/lib/gitlab/markdown.rb
index 65dce9291e6..11da4be4022 100644
--- a/lib/gitlab/markdown.rb
+++ b/lib/gitlab/markdown.rb
@@ -89,6 +89,7 @@ module Gitlab
 
       whitelist = HTML::Pipeline::SanitizationFilter::WHITELIST
       whitelist[:attributes][:all].push('class', 'id')
+      whitelist[:elements].push('span')
 
       # Remove the rel attribute that the sanitize gem adds, and remove the
       # href attribute if it contains inline javascript
@@ -123,7 +124,7 @@ module Gitlab
         text = parse_tasks(text)
       end
 
-      text
+      text.html_safe
     end
 
     private
-- 
cgit v1.2.1