Defect #22115 » 22115-dont_double_escape_deleted_diff_parts.diff
| lib/redmine/helpers/diff.rb | ||
|---|---|---|
| 53 | 53 |
else |
| 54 | 54 |
del_at = pos unless del_at |
| 55 | 55 |
deleted << ' ' unless deleted.empty? |
| 56 |
deleted << h(change[2])
|
|
| 56 |
deleted << change[2]
|
|
| 57 | 57 |
words_del += 1 |
| 58 | 58 |
end |
| 59 | 59 |
end |
| ... | ... | |
| 62 | 62 |
words[add_to] = words[add_to] + '</span>'.html_safe |
| 63 | 63 |
end |
| 64 | 64 |
if del_at |
| 65 |
words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + deleted + '</span>'.html_safe |
|
| 65 |
# deleted is not safe html at this point |
|
| 66 |
words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + h(deleted) + '</span>'.html_safe |
|
| 66 | 67 |
dels += 1 |
| 67 | 68 |
del_off += words_del |
| 68 | 69 |
words_del = 0 |
| 69 | 70 |
end |
| 70 | 71 |
end |
| 71 |
words.join(' ').html_safe
|
|
| 72 |
safe_join(words, ' ')
|
|
| 72 | 73 |
end |
| 73 | 74 |
end |
| 74 | 75 |
end |
| test/unit/lib/redmine/helpers/diff_test.rb | ||
|---|---|---|
| 22 | 22 |
diff = Redmine::Helpers::Diff.new("foo", "bar")
|
| 23 | 23 |
assert_not_nil diff |
| 24 | 24 |
end |
| 25 |
|
|
| 26 |
def test_dont_double_escape |
|
| 27 |
# 3 cases to test in the before: first word, last word, everything inbetween |
|
| 28 |
before = "<stuff> with html & special chars</danger>" |
|
| 29 |
# all words in after are treated equal |
|
| 30 |
after = "other stuff <script>alert('foo');</alert>"
|
|
| 31 |
|
|
| 32 |
computed_diff = Redmine::Helpers::Diff.new(before, after).to_html |
|
| 33 |
expected_diff = '<span class="diff_in"><stuff> with html & special chars</danger></span> <span class="diff_out">other stuff <script>alert('foo');</alert></span>' |
|
| 34 |
|
|
| 35 |
assert_equal computed_diff, expected_diff |
|
| 36 |
end |
|
| 25 | 37 |
end |