qiita-markdown 0.20.0 → 0.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: da128a043af30b7150fe3a7cfd4e498206287f4f
-  data.tar.gz: f1c24db2c52521cb1929480e94ac6c1e710fb325
+  metadata.gz: 28a5b7b0575729c0e1ee9badeed314471aceb1c4
+  data.tar.gz: 580ab1d79419424502c77fad83427f5e8384e5cb
 SHA512:
-  metadata.gz: 26463d11cd37164156db324205e26e827bee86f060900641659d6ba106394552334408f82f896c2631ee6cc0ccb2b784d736ac57cfe0edf7a662155c2d73e7ef
-  data.tar.gz: feb783906656c3c7173ad19f3b92033d3e7fcdfe38d1d5842f22436cca6af693218ee372d7b2adb02a9a584759af513b62326f894d55ddc92f5325cc7ffd8725
+  metadata.gz: 52b5622f03f628a693e75f54db193dfb98a9debb16ffe91b11bf4b22aecbadee373093d9287b06a02e64a1e620dbdeb4116b3f303aa647546bd832e8e3271410
+  data.tar.gz: 69e71477b6a063f6e82482bedd333a49fd1d1206736620cdc98acd89a8d9cfe3c1634bffc4ba1270717b7064cbb1247508d8aa55679f3f9980cd3426cec007f8

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+## 0.20.1
+
+- Fix to sanitize `<input>` which was unexpectedly permitted
+
 ## 0.20.0
 
 - Allow `<blockquote class="twitter-tweet">`

data/lib/qiita/markdown/filters/user_input_sanitizer.rb

@@ -61,7 +61,7 @@ module Qiita
         RULE = {
           elements: %w[
             a b blockquote br code dd del details div dl dt em font h1 h2 h3 h4 h5 h6
-            hr i img input ins kbd li ol p pre q rp rt ruby s samp strike strong sub
+            hr i img ins kbd li ol p pre q rp rt ruby s samp strike strong sub
             summary sup table tbody td tfoot th thead tr ul var
           ],
           attributes: {

data/lib/qiita/markdown/version.rb

@@ -1,5 +1,5 @@
 module Qiita
   module Markdown
-    VERSION = "0.20.0"
+    VERSION = "0.20.1"
   end
 end

data/spec/qiita/markdown/processor_spec.rb

@@ -1059,6 +1059,26 @@ describe Qiita::Markdown::Processor do
       end
     end
 
+    shared_examples_for "input element" do |allowed:|
+      context "with input" do
+        let(:markdown) do
+          <<-EOS.strip_heredoc
+            <input type="checkbox"> foo
+          EOS
+        end
+
+        if allowed
+          it "allows input with some attributes" do
+            should eq "<p><input type=\"checkbox\"> foo</p>\n"
+          end
+        else
+          it "sanitizes input element" do
+            should eq "<p> foo</p>\n"
+          end
+        end
+      end
+    end
+
     shared_examples_for "data-attributes" do |allowed:|
       context "with data-attributes" do
         let(:markdown) do
@@ -1179,6 +1199,7 @@ describe Qiita::Markdown::Processor do
       include_examples "script element", allowed: false
       include_examples "malicious script in filename", allowed: false
       include_examples "iframe element", allowed: false
+      include_examples "input element", allowed: true
       include_examples "data-attributes", allowed: false
       include_examples "class attribute", allowed: true
     end
@@ -1192,6 +1213,7 @@ describe Qiita::Markdown::Processor do
       include_examples "script element", allowed: true
       include_examples "malicious script in filename", allowed: true
       include_examples "iframe element", allowed: true
+      include_examples "input element", allowed: true
       include_examples "data-attributes", allowed: true
       include_examples "class attribute", allowed: true
     end
@@ -1205,6 +1227,7 @@ describe Qiita::Markdown::Processor do
       include_examples "script element", allowed: false
       include_examples "malicious script in filename", allowed: false
       include_examples "iframe element", allowed: false
+      include_examples "input element", allowed: false
       include_examples "data-attributes", allowed: false
       include_examples "class attribute", allowed: false
     end
@@ -1218,6 +1241,7 @@ describe Qiita::Markdown::Processor do
       include_examples "script element", allowed: false
       include_examples "malicious script in filename", allowed: true
       include_examples "iframe element", allowed: false
+      include_examples "input element", allowed: false
       include_examples "data-attributes", allowed: false
       include_examples "class attribute", allowed: false
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: qiita-markdown
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.1
 platform: ruby
 authors:
 - Ryo Nakamura
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-19 00:00:00.000000000 Z
+date: 2017-06-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gemoji