qiita-markdown 0.19.0 → 0.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 83c8da2e7dd55be72fce627ec6b14cb23362346e
-  data.tar.gz: 5752e8dae6fbbd5c9f9f94dc3e4a4320b9d222fa
+  metadata.gz: 3eb75a91593610b1dd442a8d9acfc482e987ffc5
+  data.tar.gz: 8ec204270a2308ee5999c2b163e31c199c866e21
 SHA512:
-  metadata.gz: 885e5a8cc2397dfedbe970b5f85e8dc952275986912149c3a24a1068b32b1c0922b7d1fb9a19db93133410d130ccbe4cda3d45218dc15bbc9b43baf5070cf0bb
-  data.tar.gz: f2a6c4b200eb88f247c16a4d87b4807a083042050e862a58fb7392bfbb25428f7a710ba3c1d1bf67fff0c02f1a1ff2e9fc443107f4f2a987e7147d4b5a965ab1
+  metadata.gz: 61dc32d46b01408c08f07b480554ad346ef96ff629d68140c16592a5a77f90163fd5331fca5b4d206ad92aeff330bcb5d4b3e9ce4d8b9b9584329a8085e58a80
+  data.tar.gz: b5f84f32227113bfbb6a1b71f85f7a5fcd5e906dea4a177f9916ec533523bc9399f83d794f8a2f351b46fae64d03e82f47e950135d460db8ab71600758515bb6

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+## 0.19.1
+
+- Add missing sanitization for `<div>` class attribute
+
 ## 0.19.0
 
 - Drop 2.0 and 2.1 from support Ruby versions

data/lib/qiita/markdown/filters/user_input_sanitizer.rb

@@ -10,6 +10,9 @@ module Qiita
               "rel" => %w[footnote url],
               "rev" => %w[footnote],
             },
+            "div" => {
+              "class" => %w[footnotes],
+            },
             "sup" => {
               "id" => /\Afnref\d+\z/,
             },

data/lib/qiita/markdown/version.rb

@@ -1,5 +1,5 @@
 module Qiita
   module Markdown
-    VERSION = "0.19.0"
+    VERSION = "0.19.1"
   end
 end

data/spec/qiita/markdown/processor_spec.rb

@@ -1124,6 +1124,28 @@ describe Qiita::Markdown::Processor do
           end
         end
       end
+
+      context "with class attribute for <div> tag" do
+        let(:markdown) do
+          <<-EOS.strip_heredoc
+            <div class="footnotes malicious-class">foo</div>
+          EOS
+        end
+
+        if allowed
+          it "does not sanitize the classes" do
+            should eq <<-EOS.strip_heredoc
+              <div class="footnotes malicious-class">foo</div>
+            EOS
+          end
+        else
+          it "sanitizes classes except `footnotes`" do
+            should eq <<-EOS.strip_heredoc
+              <div class="footnotes">foo</div>
+            EOS
+          end
+        end
+      end
     end
 
     context "without script and strict context" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qiita-markdown
 version: !ruby/object:Gem::Version
-  version: 0.19.0
+  version: 0.19.1
 platform: ruby
 authors:
 - Ryo Nakamura