meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-03-10 19:23:06 +00:00
Code Issues Releases Wiki Activity

Merged r21850 and r21851 from trunk to 5.0-stable (#37237).

Browse Source 
git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21859 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Marius Balteanu 2022-09-27 17:11:53 +00:00
parent 0224b79ccd
commit 468377d6b5
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb
View File

@ -27,6 +27,18 @@ module Redmine
"a" => %w(href).freeze,
}.freeze
ALLOWED_CSS_PROPERTIES = %w[
color background-color
width
height
padding padding-left padding-right padding-top padding-bottom
margin margin-left margin-right margin-top margin-bottom
border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
font font-style font-variant font-weight font-stretch font-size line-height font-family
text-align
float
].freeze
def allowlist
@allowlist ||= customize_allowlist(super.deep_dup)
end
@ -40,6 +52,9 @@ module Redmine
allowlist[:attributes][:all].delete("name")
allowlist[:attributes]["a"].push("name")
allowlist[:attributes][:all].push("style")
allowlist[:css] = { properties: ALLOWED_CSS_PROPERTIES }
# allow class on code tags (this holds the language info from fenced
# code bocks and has the format language-foo)
allowlist[:attributes]["code"] = %w(class)

13
public/help/en/wiki_syntax_detailed_common_mark.html
View File

@ -356,6 +356,19 @@ It can be expanded by clicking a link.
<tr><td align="center" colspan="2">bar</td></tr>
</table>
<p>The <strong>style</strong> attribute can be used in raw HTML to apply custom formatting. The following CSS properties are allowed:</p>
<pre><code>
color background-color
width
height
padding padding-left padding-right padding-top padding-bottom
margin margin-left margin-right margin-top margin-bottom
border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
font font-style font-variant font-weight font-stretch font-size line-height font-family
text-align
float
</code></pre>
</body>
</html>

4
test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb
View File

@ -93,6 +93,10 @@ if Object.const_defined?(:CommonMarker)
# samples taken from the Sanitize test suite
# rubocop:disable Layout/LineLength
STRINGS = [
[
'<span style="color: #333; background: url(\'https://example.com/evil.svg\')">hello</span>"',
'<span style="color: #333; ">hello</span>"'
],
[
'<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo" style="text-decoration: underline;">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>',
'<b>Lorem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br>amet .foo { color: #fff; } '