Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
b82aba0e
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
b82aba0e
编写于
11月 09, 2018
作者:
B
Brett Walker
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Sanitize output of SpacedLinkFilter
上级
624ec622
变更
5
隐藏空白更改
内联
并排
Showing
5 changed file
with
25 addition
and
2 deletion
+25
-2
app/models/concerns/cache_markdown_field.rb
app/models/concerns/cache_markdown_field.rb
+1
-1
changelogs/unreleased/security-xss-in-markdown-following-unrecognized-html-element.yml
...y-xss-in-markdown-following-unrecognized-html-element.yml
+5
-0
lib/banzai/filter/spaced_link_filter.rb
lib/banzai/filter/spaced_link_filter.rb
+3
-0
lib/banzai/pipeline/gfm_pipeline.rb
lib/banzai/pipeline/gfm_pipeline.rb
+4
-1
spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
+12
-0
未找到文件。
app/models/concerns/cache_markdown_field.rb
浏览文件 @
b82aba0e
...
...
@@ -15,7 +15,7 @@ module CacheMarkdownField
# Increment this number every time the renderer changes its output
CACHE_REDCARPET_VERSION
=
3
CACHE_COMMONMARK_VERSION_START
=
10
CACHE_COMMONMARK_VERSION
=
1
1
CACHE_COMMONMARK_VERSION
=
1
2
# changes to these attributes cause the cache to be invalidates
INVALIDATED_BY
=
%w[author project]
.
freeze
...
...
changelogs/unreleased/security-xss-in-markdown-following-unrecognized-html-element.yml
0 → 100644
浏览文件 @
b82aba0e
---
title
:
Fix possible XSS attack in Markdown urls with spaces
merge_request
:
2599
author
:
type
:
security
lib/banzai/filter/spaced_link_filter.rb
浏览文件 @
b82aba0e
...
...
@@ -17,6 +17,9 @@ module Banzai
# This is a small extension to the CommonMark spec. If they start allowing
# spaces in urls, we could then remove this filter.
#
# Note: Filter::SanitizationFilter should always be run sometime after this filter
# to prevent XSS attacks
#
class
SpacedLinkFilter
<
HTML
::
Pipeline
::
Filter
include
ActionView
::
Helpers
::
TagHelper
...
...
lib/banzai/pipeline/gfm_pipeline.rb
浏览文件 @
b82aba0e
...
...
@@ -12,13 +12,16 @@ module Banzai
def
self
.
filters
@filters
||=
FilterArray
[
Filter
::
PlantumlFilter
,
# Must always be before the SanitizationFilter to prevent XSS attacks
Filter
::
SpacedLinkFilter
,
Filter
::
SanitizationFilter
,
Filter
::
SyntaxHighlightFilter
,
Filter
::
MathFilter
,
Filter
::
ColorFilter
,
Filter
::
MermaidFilter
,
Filter
::
SpacedLinkFilter
,
Filter
::
VideoLinkFilter
,
Filter
::
ImageLazyLoadFilter
,
Filter
::
ImageLinkFilter
,
...
...
spec/lib/banzai/pipeline/gfm_pipeline_spec.rb
浏览文件 @
b82aba0e
...
...
@@ -104,5 +104,17 @@ describe Banzai::Pipeline::GfmPipeline do
expect
(
output
).
to
include
(
"src=
\"
test%20image.png
\"
"
)
end
it
'sanitizes the fixed link'
do
markdown_xss
=
"[xss](javascript: alert%28document.domain%29)"
output
=
described_class
.
to_html
(
markdown_xss
,
project:
project
)
expect
(
output
).
not_to
include
(
"javascript"
)
markdown_xss
=
"<invalidtag>
\n
[xss](javascript:alert%28document.domain%29)"
output
=
described_class
.
to_html
(
markdown_xss
,
project:
project
)
expect
(
output
).
not_to
include
(
"javascript"
)
end
end
end
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录