gollum 1.1.0 → 1.1.1

data/HISTORY.md

@@ -1,3 +1,8 @@
+# 1.1.1 / 2011-1-11
+
+* Bug Fixes
+  * Critical shell escaping bug with syntax highlighting fixed.
+
 # 1.1.0 / 2010-10-28
 
 * Major Enhancements

data/gollum.gemspec

@@ -4,8 +4,8 @@ Gem::Specification.new do |s|
   s.rubygems_version = '1.3.5'
 
   s.name              = 'gollum'
-  s.version           = '1.1.0'
-  s.date              = '2010-10-28'
+  s.version           = '1.1.1'
+  s.date              = '2011-01-11'
   s.rubyforge_project = 'gollum'
 
   s.summary     = "A simple, Git-powered wiki."
@@ -25,7 +25,7 @@ Gem::Specification.new do |s|
 
   s.add_dependency('grit', "~> 2.3")
   s.add_dependency('github-markup', [">= 0.4.0", "< 1.0.0"])
-  s.add_dependency('albino', "~> 1.0")
+  s.add_dependency('albino', "~> 1.1.1")
   s.add_dependency('sinatra', "~> 1.0")
   s.add_dependency('mustache', [">= 0.11.2", "< 1.0.0"])
   s.add_dependency('sanitize', "~> 1.1")

data/lib/gollum.rb

@@ -20,7 +20,7 @@ require 'gollum/markup'
 require 'gollum/albino'
 
 module Gollum
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 
   SANITIZATION_OPTIONS = {
     :elements => [

data/lib/gollum/albino.rb

@@ -14,4 +14,17 @@ class Gollum::Albino < Albino
     html.sub!(%r{</pre></div>\Z}, "</pre>\n</div>")
     html
   end
+
+  # Hotfix for vulnerable versions of Albino
+  if !instance_methods.include?('shell_escape')
+    def convert_options(options = {})
+      @options.merge(options).inject('') do |string, (flag, value)|
+        string + " -#{flag} #{shell_escape value}"
+      end
+    end
+
+    def shell_escape(str)
+      str.to_s.gsub("'", "\\\\'").gsub(";", '\\;')
+    end
+  end
 end

data/lib/gollum/markup.rb

@@ -347,7 +347,7 @@ module Gollum
     #
     # Returns the placeholder'd String data.
     def extract_code(data)
-      data.gsub(/^``` ?(.+?)\r?\n(.+?)\r?\n```\r?$/m) do
+      data.gsub(/^``` ?([^\r\n]+)?\r?\n(.+?)\r?\n```\r?$/m) do
         id = Digest::SHA1.hexdigest($2)
         @codemap[id] = { :lang => $1, :code => $2 }
         id
@@ -362,12 +362,15 @@ module Gollum
     # Returns the marked up String data.
     def process_code(data)
       @codemap.each do |id, spec|
-        lang = spec[:lang]
         code = spec[:code]
         if code.lines.all? { |line| line =~ /\A\r?\n\Z/ || line =~ /^(  |\t)/ }
           code.gsub!(/^(  |\t)/m, '')
         end
-        data.gsub!(id, Gollum::Albino.new(code, lang).colorize)
+        if lang = spec[:lang]
+          data.gsub!(id, Gollum::Albino.new(code, lang).colorize)
+        else
+          data.gsub!(id, "<pre><code>#{CGI.escapeHTML(code)}</code></pre>")
+        end
       end
       data
     end

data/test/test_markup.rb

@@ -353,6 +353,18 @@ context "Markup" do
     compare(content, output)
   end
 
+  test "code block with invalid lang" do
+    content = "a\n\n``` ls -al;\n\tbooya\n\tboom\n```\n\nb"
+    output = "<p>a</p>\n\n\n\n<p>b</p>"
+    compare(content, output)
+  end
+
+  test "code block with no lang" do
+    content = "a\n\n```\n\tls -al;\n\t<booya>\n```\n\nb"
+    output = "<p>a</p>\n\n<pre><code>ls -al;\n&lt;booya&gt;</code></pre>\n\n<p>b</p>"
+    compare(content, output)
+  end
+
   #########################################################################
   #
   # Various

metadata

@@ -1,13 +1,12 @@
 --- !ruby/object:Gem::Specification 
 name: gollum
 version: !ruby/object:Gem::Version 
-  hash: 19
   prerelease: false
   segments: 
   - 1
   - 1
-  - 0
-  version: 1.1.0
+  - 1
+  version: 1.1.1
 platform: ruby
 authors: 
 - Tom Preston-Werner
@@ -16,18 +15,16 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-10-28 00:00:00 -07:00
+date: 2011-01-11 00:00:00 -08:00
 default_executable: gollum
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: grit
   prerelease: false
   requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 5
         segments: 
         - 2
         - 3
@@ -38,11 +35,9 @@ dependencies:
   name: github-markup
   prerelease: false
   requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 15
         segments: 
         - 0
         - 4
@@ -50,7 +45,6 @@ dependencies:
         version: 0.4.0
     - - <
       - !ruby/object:Gem::Version 
-        hash: 23
         segments: 
         - 1
         - 0
@@ -62,26 +56,23 @@ dependencies:
   name: albino
   prerelease: false
   requirement: &id003 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 15
         segments: 
         - 1
-        - 0
-        version: "1.0"
+        - 1
+        - 1
+        version: 1.1.1
   type: :runtime
   version_requirements: *id003
 - !ruby/object:Gem::Dependency 
   name: sinatra
   prerelease: false
   requirement: &id004 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 15
         segments: 
         - 1
         - 0
@@ -92,11 +83,9 @@ dependencies:
   name: mustache
   prerelease: false
   requirement: &id005 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 55
         segments: 
         - 0
         - 11
@@ -104,7 +93,6 @@ dependencies:
         version: 0.11.2
     - - <
       - !ruby/object:Gem::Version 
-        hash: 23
         segments: 
         - 1
         - 0
@@ -116,11 +104,9 @@ dependencies:
   name: sanitize
   prerelease: false
   requirement: &id006 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 13
         segments: 
         - 1
         - 1
@@ -131,11 +117,9 @@ dependencies:
   name: nokogiri
   prerelease: false
   requirement: &id007 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7
         segments: 
         - 1
         - 4
@@ -146,11 +130,9 @@ dependencies:
   name: RedCloth
   prerelease: false
   requirement: &id008 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
@@ -160,11 +142,9 @@ dependencies:
   name: mocha
   prerelease: false
   requirement: &id009 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
@@ -174,11 +154,9 @@ dependencies:
   name: org-ruby
   prerelease: false
   requirement: &id010 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
@@ -188,11 +166,9 @@ dependencies:
   name: rdiscount
   prerelease: false
   requirement: &id011 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
@@ -202,11 +178,9 @@ dependencies:
   name: shoulda
   prerelease: false
   requirement: &id012 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
@@ -700,27 +674,23 @@ rdoc_options:
 require_paths: 
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
 requirements: []
 
 rubyforge_project: gollum
-rubygems_version: 1.3.7
+rubygems_version: 1.3.6
 signing_key: 
 specification_version: 2
 summary: A simple, Git-powered wiki.