Redmine

I cannot reproduce on vanilla Redmine 3.2.3 ruby 1.9.3p551 (2014-11-13 revision 48407) [x86_64-linux].

Hi,

The problem exists only with the markdown text format. The textile format is ok.

Did you test with this markdown text format ?

I've just set a vanilla redmine 3.2.3 (tarball from the website). And I can reproduce this bug.

Regards,
Philippe Le Brouster

I made some tests based on the first 5 examples added by Adrien Crivelli in his post. The tests fail on both Textile and Markdown formatters.

I made also a potential patch that fixes these issues. I'm saying just potential because I'm not sure if it is ok from a security point of view. From my tests it is ok, but I need a second opinion.

Regarding the case "[[also <broken> link]]", is harder to make a fix because the tag is completely removed by the markdown formatter.

I'm considering this issue quite annoying and I would like to fix it in a next version. @Go Maeda, which version do you think is more appropriate?

Update the patch for r17346.

The following patch also works. Marius, do you think it is OK? I prefer this code because it is simpler and CGI.unescapeHTML is already used in application_helper.rb.

Index: app/helpers/application_helper.rb
===================================================================
--- app/helpers/application_helper.rb    (revision 17346)
+++ app/helpers/application_helper.rb    (working copy)
@@ -740,6 +740,7 @@
       link_project = project
       esc, all, page, title = $1, $2, $3, $5
       if esc.nil?
+        page = CGI.unescapeHTML(page)
         if page =~ /^\#(.+)$/
           anchor = sanitize_anchor_name($1)
           url = "##{anchor}" 

LGTM. I'm not sure why I chose then the htmlentities gem instead of CGI, I think that I've read somewhere that it is better, but I can't find anymore.

Anyway, the single concern I have is regarding how safe are our both solution against XSS, but from my tests, everything looks good. Maybe we should let Jean-Philippe Lang to fix this one.

Patch committed, thanks.