Commit 0b63bb6e authored by Robert Speicher's avatar Robert Speicher Committed by Job van der Voort

Customize the sanitization whitelist only once

Fixes #1651
parent 98f12863
...@@ -8,28 +8,33 @@ module Gitlab ...@@ -8,28 +8,33 @@ module Gitlab
# Extends HTML::Pipeline::SanitizationFilter with a custom whitelist. # Extends HTML::Pipeline::SanitizationFilter with a custom whitelist.
class SanitizationFilter < HTML::Pipeline::SanitizationFilter class SanitizationFilter < HTML::Pipeline::SanitizationFilter
def whitelist def whitelist
whitelist = HTML::Pipeline::SanitizationFilter::WHITELIST whitelist = super
# Allow code highlighting # Only push these customizations once
whitelist[:attributes]['pre'] = %w(class) unless customized?(whitelist[:transformers])
whitelist[:attributes]['span'] = %w(class) # Allow code highlighting
whitelist[:attributes]['pre'] = %w(class)
whitelist[:attributes]['span'] = %w(class)
# Allow table alignment # Allow table alignment
whitelist[:attributes]['th'] = %w(style) whitelist[:attributes]['th'] = %w(style)
whitelist[:attributes]['td'] = %w(style) whitelist[:attributes]['td'] = %w(style)
# Allow span elements # Allow span elements
whitelist[:elements].push('span') whitelist[:elements].push('span')
# Remove `rel` attribute from `a` elements # Remove `rel` attribute from `a` elements
whitelist[:transformers].push(remove_rel) whitelist[:transformers].push(remove_rel)
# Remove `class` attribute from non-highlight spans # Remove `class` attribute from non-highlight spans
whitelist[:transformers].push(clean_spans) whitelist[:transformers].push(clean_spans)
end
whitelist whitelist
end end
private
def remove_rel def remove_rel
lambda do |env| lambda do |env|
if env[:node_name] == 'a' if env[:node_name] == 'a'
...@@ -48,6 +53,10 @@ module Gitlab ...@@ -48,6 +53,10 @@ module Gitlab
end end
end end
end end
def customized?(transformers)
transformers.last.source_location[0] == __FILE__
end
end end
end end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment