Feature #32766

Remove the URI limitation from external markdown links

Added by Simon Busse over 1 year ago. Updated 5 months ago.

Status:NewStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:Text formatting
Target version:-
Resolution:

Description

Problem (usecase)
The Markdown Module of Redmine limits the possible URIs in markdown written links (RedmineTextFormattingMarkdown). But for us it is a very important feature to be able to link directly from Redmine to other apps. Therefore we need to be able to set links e.g. with the URI zpl://... (zeplin.io App on MacOS). With Textile this is possible, but not with Markdown.
IMHO the security gain of the limitation is small, especially since there is no limitation with Textile.

possible solution
Remove the URI limitation in Markdown (/lib/redmine/helpers/uri.rb). Alternatively, the possible URIs could be made adjustable.


Related issues

Related to Redmine - Patch #32424: CommonMark Markdown Text Formatting New

History

#1 Updated by Simon Busse over 1 year ago

As a note: for us we have solved the problem with a "fix" plugin (https://github.com/laborb/redmine_lab_uri_schemes).
Nevertheless I would consider a solution in the core to be useful.

#2 Updated by Declan Jackson over 1 year ago

Simon Busse wrote:

As a note: for us we have solved the problem with a "fix" plugin (https://github.com/laborb/redmine_lab_uri_schemes).
Nevertheless I would consider a solution in the core to be useful.

It is nice to be here...

#3 Updated by Janeks Kamerovskis 6 months ago

Declan Jackson wrote:

Simon Busse wrote:

As a note: for us we have solved the problem with a "fix" plugin (https://github.com/laborb/redmine_lab_uri_schemes).
Nevertheless I would consider a solution in the core to be useful.

It is nice to be here...

+1

#4 Updated by Martin Cizek 5 months ago

In CommonMark formatting patch #32424, I've added Redmine::Helpers::URL#uri_with_link_safe_scheme? method.

If it were applied, the fix for the old Markdown formatting would be:

--- a/lib/redmine/wiki_formatting/markdown/formatter.rb
+++ b/lib/redmine/wiki_formatting/markdown/formatter.rb
@@ -27,7 +27,7 @@ module Redmine
         include Redmine::Helpers::URL

         def link(link, title, content)
-          return nil unless uri_with_safe_scheme?(link)
+          return nil unless uri_with_link_safe_scheme?(link)

           css = nil
           unless link && link.starts_with?('/')

This new helper method can then be used also to replace the hardcoded test in Textile (href.downcase.start_with?('javascript:')).

#5 Updated by Go MAEDA 4 months ago

  • Related to Patch #32424: CommonMark Markdown Text Formatting added

Also available in: Atom PDF