From 378da4b031b529001e8f0e2ef7979dcb2136d01b Mon Sep 17 00:00:00 2001 From: Jens Kraemer Date: Wed, 1 Jun 2022 17:43:29 +0800 Subject: [PATCH 3/3] uses the new html sanitizer for links rendered by custom fields --- lib/redmine/field_format.rb | 12 +++++++----- .../lib/redmine/field_format/field_format_test.rb | 8 ++++---- .../lib/redmine/field_format/link_format_test.rb | 14 +++++++------- .../lib/redmine/field_format/list_format_test.rb | 4 ++-- .../redmine/field_format/numeric_format_test.rb | 2 +- 5 files changed, 21 insertions(+), 19 deletions(-) diff --git a/lib/redmine/field_format.rb b/lib/redmine/field_format.rb index 5068667e18..759a4a2b01 100644 --- a/lib/redmine/field_format.rb +++ b/lib/redmine/field_format.rb @@ -255,15 +255,18 @@ module Redmine [text, url] end links = texts_and_urls.sort_by(&:first).map do |text, url| - css_class = (/^https?:\/\//.match?(url)) ? 'external' : nil - view.link_to_if uri_with_safe_scheme?(url), text, url, :class => css_class + view.link_to text, url end - links.join(', ').html_safe + sanitize_html links.join(', ') else casted end end + def sanitize_html(html) + Redmine::WikiFormatting::HtmlSanitizer.call(html).html_safe + end + # Returns an URL generated with the custom field URL pattern # and variables substitution: # %value% => the custom field value @@ -463,8 +466,7 @@ module Redmine url = "http://" + url end end - css_class = (/^https?:\/\//.match?(url)) ? 'external' : nil - view.link_to value.to_s.truncate(40), url, :class => css_class + sanitize_html view.link_to(value.to_s.truncate(40), url) else value.to_s end diff --git a/test/unit/lib/redmine/field_format/field_format_test.rb b/test/unit/lib/redmine/field_format/field_format_test.rb index 5bcda21568..ee3ac72835 100644 --- a/test/unit/lib/redmine/field_format/field_format_test.rb +++ b/test/unit/lib/redmine/field_format/field_format_test.rb @@ -79,7 +79,7 @@ class Redmine::FieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "bar") assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) end def test_text_field_with_url_pattern_and_value_containing_a_space_should_format_as_link @@ -87,7 +87,7 @@ class Redmine::FieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "foo bar") assert_equal "foo bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'foo bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'foo bar', field.format.formatted_custom_value(self, custom_value, true) end def test_text_field_with_url_pattern_should_not_encode_url_pattern @@ -95,7 +95,7 @@ class Redmine::FieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "1") assert_equal "1", field.format.formatted_custom_value(self, custom_value, false) - assert_equal '1', field.format.formatted_custom_value(self, custom_value, true) + assert_equal '1', field.format.formatted_custom_value(self, custom_value, true) end def test_text_field_with_url_pattern_should_encode_values @@ -103,6 +103,6 @@ class Redmine::FieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "foo bar") assert_equal "foo bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'foo bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'foo bar', field.format.formatted_custom_value(self, custom_value, true) end end diff --git a/test/unit/lib/redmine/field_format/link_format_test.rb b/test/unit/lib/redmine/field_format/link_format_test.rb index e55b0b5af0..d3666f5d06 100644 --- a/test/unit/lib/redmine/field_format/link_format_test.rb +++ b/test/unit/lib/redmine/field_format/link_format_test.rb @@ -31,7 +31,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "bar") assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_should_substitute_object_id_in_url @@ -42,7 +42,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => object, :value => "bar") assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_should_substitute_project_id_in_url @@ -55,7 +55,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => object, :value => "bar") assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_should_substitute_project_identifier_in_url @@ -68,7 +68,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => object, :value => "bar") assert_equal "bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'bar', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_should_substitute_regexp_groups @@ -76,7 +76,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "56-142") assert_equal "56-142", field.format.formatted_custom_value(self, custom_value, false) - assert_equal '56-142', field.format.formatted_custom_value(self, custom_value, true) + assert_equal '56-142', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_without_url_pattern_should_link_to_value @@ -84,7 +84,7 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "http://foo/bar") assert_equal "http://foo/bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'http://foo/bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'http://foo/bar', field.format.formatted_custom_value(self, custom_value, true) end def test_link_field_without_url_pattern_should_link_to_value_with_http_by_default @@ -92,6 +92,6 @@ class Redmine::LinkFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "foo.bar") assert_equal "foo.bar", field.format.formatted_custom_value(self, custom_value, false) - assert_equal 'foo.bar', field.format.formatted_custom_value(self, custom_value, true) + assert_equal 'foo.bar', field.format.formatted_custom_value(self, custom_value, true) end end diff --git a/test/unit/lib/redmine/field_format/list_format_test.rb b/test/unit/lib/redmine/field_format/list_format_test.rb index 2d2a1dbe83..d2ec52aeb5 100644 --- a/test/unit/lib/redmine/field_format/list_format_test.rb +++ b/test/unit/lib/redmine/field_format/list_format_test.rb @@ -144,14 +144,14 @@ class Redmine::ListFieldFormatTest < ActionView::TestCase def test_field_with_url_pattern_should_link_value field = IssueCustomField.new(:field_format => 'list', :url_pattern => 'http://localhost/%value%') formatted = field.format.formatted_value(self, field, 'foo', Issue.new, true) - assert_equal 'foo', formatted + assert_equal 'foo', formatted assert formatted.html_safe? end def test_field_with_url_pattern_and_multiple_values_should_link_values field = IssueCustomField.new(:field_format => 'list', :url_pattern => 'http://localhost/%value%') formatted = field.format.formatted_value(self, field, ['foo', 'bar'], Issue.new, true) - assert_equal 'bar, foo', formatted + assert_equal 'bar, foo', formatted assert formatted.html_safe? end diff --git a/test/unit/lib/redmine/field_format/numeric_format_test.rb b/test/unit/lib/redmine/field_format/numeric_format_test.rb index fa558a3775..1cee59a4f9 100644 --- a/test/unit/lib/redmine/field_format/numeric_format_test.rb +++ b/test/unit/lib/redmine/field_format/numeric_format_test.rb @@ -32,6 +32,6 @@ class Redmine::NumericFieldFormatTest < ActionView::TestCase custom_value = CustomValue.new(:custom_field => field, :customized => Issue.new, :value => "3") assert_equal 3, field.format.formatted_custom_value(self, custom_value, false) - assert_equal '3', field.format.formatted_custom_value(self, custom_value, true) + assert_equal '3', field.format.formatted_custom_value(self, custom_value, true) end end -- 2.30.2