qiita-markdown 0.31.0 → 0.36.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6dc488d1b11fcc036257f3af15d078c4c708fa5f53a0532fc441827e0a48ab8b
-  data.tar.gz: 540af5a59e96989cc6c5b4fc890803b91011ab9acb7b16f81e32c405406cebf8
+  metadata.gz: c87f030f51598557770e12094601817c916a8e468cd030aeead44855b982dd14
+  data.tar.gz: 93a458246834fe89530ae20396dbffc98436be494331df2505359727e4fea92d
 SHA512:
-  metadata.gz: add793f489cec5f024e8781afce29073996de60de601d7d4d2da941e06a6679f39b73a9aad317303b51fd78a3607c538a444c340e8314339cf89b9281e9f3cee
-  data.tar.gz: c56d7ff646cd8fb9c16d936199367d6a73c1be1c0e4a22734c8567aed6ab0b2789493537f05e7076dc7c5a6e1def4ce0d9d4bd4e41e1226d75b56756dfe8a968
+  metadata.gz: c94ef6737d7881c6ab6ebb7078eb9b24be05d3804362cdde38d37f16397cb2a635f1b1d7a215d61e57effa0f1043eb2c6f901d70dff6b70ae2595e2c446208e0
+  data.tar.gz: 7e8941da6683eb93716e05ecb89528b6208ceac2f02107c43aa3792ff6ddc302ed0fba27a7bf8a0cd488e8c66e27dc53a7c6432981e7c9b7961e24c41094cee3

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 ## Unreleased
 
+## 0.36.0
+- Support message notation
+
+## 0.35.0
+
+- Allow Relative URL in iframe src attributes
+
+## 0.34.0
+
+- Delete gist embed rule to avoid XSS
+
+## 0.33.0
+
+- Fix XSS possibility bug
+
+## 0.32.0
+
+- Fix XSS possibility bug
+- Fix iframe width to be fixed at 100%
+
 ## 0.31.0
 
 - Use greenmat 3.5.1.1

data/lib/qiita/markdown.rb

@@ -10,7 +10,6 @@ require "sanitize"
 require "qiita/markdown/embed/code_pen"
 require "qiita/markdown/embed/tweet"
 require "qiita/markdown/embed/asciinema"
-require "qiita/markdown/embed/gist"
 require "qiita/markdown/embed/youtube"
 require "qiita/markdown/embed/slide_share"
 require "qiita/markdown/embed/google_slide"
@@ -21,6 +20,7 @@ require "qiita/markdown/transformers/filter_iframe"
 require "qiita/markdown/transformers/strip_invalid_node"
 require "qiita/markdown/filters/checkbox"
 require "qiita/markdown/filters/code_block"
+require "qiita/markdown/filters/custom_block"
 require "qiita/markdown/filters/emoji"
 require "qiita/markdown/filters/external_link"
 require "qiita/markdown/filters/final_sanitizer"

data/lib/qiita/markdown/filters/custom_block.rb

@@ -0,0 +1,63 @@
+module Qiita
+  module Markdown
+    module Filters
+      class CustomBlock < HTML::Pipeline::Filter
+        ALLOWED_TYPES = %(message).freeze
+
+        def call
+          doc.search('div[data-type="customblock"]').each do |div|
+            metadata = Metadata.new(div["data-metadata"])
+            next unless ALLOWED_TYPES.include?(metadata.type)
+            klass = Object.const_get("#{self.class}::#{metadata.type.capitalize}")
+            klass.new(div, metadata.subtype).convert
+          end
+          doc
+        end
+
+        class Metadata
+          attr_reader :type, :subtype
+
+          # @param text [String, nil]
+          def initialize(text)
+            # Discared after the second word.
+            @type, @subtype = text.split(" ")
+          end
+        end
+
+        class Message
+          attr_reader :node, :type
+
+          ALLOWED_TYPES = %w[info warn alert].freeze
+          DEFAULT_TYPE = "info".freeze
+
+          # @param node [Nokogiri::XML::Node]
+          # @param type [String, nil]
+          def initialize(node, type)
+            @node = node
+            @type = ALLOWED_TYPES.include?(type) ? type : DEFAULT_TYPE
+          end
+
+          def convert
+            node.inner_html = message
+            node["class"] = "message #{type}"
+            node.children.first.add_previous_sibling(icon) if icon
+          end
+
+          private
+
+          def message
+            "<p>#{node.text}</p>"
+          end
+
+          def icon
+            {
+              info: %(<span class="fa fa-fw fa-check-circle"></span>),
+              warn: %(<span class="fa fa-fw fa-exclamation-circle"></span>),
+              alert: %(<span class="fa fa-fw fa-times-circle"></span>),
+            }[type.to_sym]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/qiita/markdown/filters/greenmat.rb

@@ -20,6 +20,7 @@ module Qiita
             Qiita::Markdown::Greenmat::HTMLRenderer.new(hard_wrap: true, with_toc_data: true),
             autolink: true,
             fenced_code_blocks: true,
+            fenced_custom_blocks: true,
             footnotes: options[:footnotes],
             no_intra_emphasis: true,
             no_mention_emphasis: true,

data/lib/qiita/markdown/filters/user_input_sanitizer.rb

@@ -13,7 +13,7 @@ module Qiita
             "a"          => %w[class href rel title],
             "blockquote" => %w[cite] + Embed::Tweet::ATTRIBUTES,
             "code"       => %w[data-metadata],
-            "div"        => %w[class],
+            "div"        => %w[class data-type data-metadata],
             "font"       => %w[color],
             "h1"         => %w[id],
             "h2"         => %w[id],

data/lib/qiita/markdown/processor.rb

@@ -14,6 +14,7 @@ module Qiita
           Filters::ImageLink,
           Filters::Footnote,
           Filters::CodeBlock,
+          Filters::CustomBlock,
           Filters::Checkbox,
           Filters::Toc,
           Filters::Emoji,

data/lib/qiita/markdown/transformers/filter_iframe.rb

@@ -22,6 +22,7 @@ module Qiita
         def transform
           if name == "iframe"
             if URL_WHITE_LIST.include?(node["src"]) || HOST_WHITE_LIST.include?(host_of(node["src"]))
+              node["width"] = "100%"
               node.children.unlink
             else
               node.unlink
@@ -40,8 +41,11 @@ module Qiita
         end
 
         def host_of(url)
-          Addressable::URI.parse(url).host if url
-        rescue Addressable::URI::InvalidURIError
+          if url
+            scheme = URI.parse(url).scheme
+            Addressable::URI.parse(url).host if ["http", "https", nil].include? scheme
+          end
+        rescue Addressable::URI::InvalidURIError, URI::InvalidURIError
           nil
         end
       end

data/lib/qiita/markdown/transformers/filter_script.rb

@@ -10,7 +10,6 @@ module Qiita
 
         HOST_WHITE_LIST = [
           Embed::Asciinema::SCRIPT_HOST,
-          Embed::Gist::SCRIPT_HOST,
         ].flatten.freeze
 
         def self.call(*args)
@@ -43,8 +42,11 @@ module Qiita
         end
 
         def host_of(url)
-          Addressable::URI.parse(url).host if url
-        rescue Addressable::URI::InvalidURIError
+          if url
+            scheme = URI.parse(url).scheme
+            Addressable::URI.parse(url).host if ["http", "https"].include? scheme
+          end
+        rescue Addressable::URI::InvalidURIError, URI::InvalidURIError
           nil
         end
       end

data/lib/qiita/markdown/version.rb

@@ -1,5 +1,5 @@
 module Qiita
   module Markdown
-    VERSION = "0.31.0"
+    VERSION = "0.36.0"
   end
 end

data/qiita-markdown.gemspec

@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "html-pipeline", "~> 2.0"
   spec.add_dependency "mem"
   spec.add_dependency "pygments.rb", "~> 1.0"
-  spec.add_dependency "greenmat", "3.5.1.1"
+  spec.add_dependency "greenmat", "3.5.1.2"
   spec.add_dependency "sanitize"
   spec.add_dependency "addressable"
   spec.add_development_dependency "activesupport", "4.2.6"

data/spec/qiita/markdown/processor_spec.rb

@@ -1144,12 +1144,13 @@ describe Qiita::Markdown::Processor do
     end
 
     shared_examples_for "iframe element" do |allowed:|
-      context "with iframe" do
+      shared_examples "iframe element example" do
         let(:markdown) do
           <<-MARKDOWN.strip_heredoc
-            <iframe width="1" height="2" src="//example.com" frameborder="0" allowfullscreen></iframe>
+            <iframe width="1" height="2" src="#{url}" frameborder="0" allowfullscreen></iframe>
           MARKDOWN
         end
+        let(:url) { "#{scheme}//example.com" }
 
         if allowed
           it "allows iframe with some attributes" do
@@ -1161,6 +1162,20 @@ describe Qiita::Markdown::Processor do
           end
         end
       end
+
+      context "with iframe" do
+        context "with scheme" do
+          let(:scheme) { "https:" }
+
+          include_examples "iframe element example"
+        end
+
+        context "without scheme" do
+          let(:scheme) { "" }
+
+          include_examples "iframe element example"
+        end
+      end
     end
 
     shared_examples_for "input element" do |allowed:|
@@ -1451,81 +1466,137 @@ describe Qiita::Markdown::Processor do
         end
       end
 
-      context "with HTML embed code for Gist" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <script id="example" src="https://gist.github.com/a/example.js"></script>
-          MARKDOWN
-        end
+      context "with HTML embed code for Youtube" do
+        shared_examples "embed code youtube example" do
+          let(:markdown) do
+            <<-MARKDOWN.strip_heredoc
+              <iframe width="100" height="100" src="#{url}"></iframe>
+            MARKDOWN
+          end
+          let(:url) { "#{scheme}//www.youtube.com/embed/example" }
 
-        if allowed
-          it "does not sanitize embed code" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js"></script>
-            HTML
+          if allowed
+            it "does not sanitize embed code" do
+              should eq <<-HTML.strip_heredoc
+                <iframe width="100" height="100" src="#{url}"></iframe>
+              HTML
+            end
+          else
+            it "forces width attribute on iframe" do
+              should eq <<-HTML.strip_heredoc
+                <iframe width="100%" height="100" src="#{url}"></iframe>
+              HTML
+            end
           end
-        else
-          it "forces async attribute on script" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js" async="async"></script>
-            HTML
+
+          context "when url is privacy enhanced mode" do
+            let(:markdown) do
+              <<-MARKDOWN.strip_heredoc
+                <iframe width="100" height="100" src="#{url}"></iframe>
+              MARKDOWN
+            end
+            let(:url) { "#{scheme}//www.youtube-nocookie.com/embed/example" }
+
+            if allowed
+              it "does not sanitize embed code" do
+                should eq <<-HTML.strip_heredoc
+                  <iframe width="100" height="100" src="#{url}"></iframe>
+                HTML
+              end
+            else
+              it "forces width attribute on iframe" do
+                should eq <<-HTML.strip_heredoc
+                  <iframe width="100%" height="100" src="#{url}"></iframe>
+                HTML
+              end
+            end
           end
         end
-      end
 
-      context "with HTML embed code for Youtube" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <iframe width="100" height="100" src="https://www.youtube.com/embed/example"></iframe>
-          MARKDOWN
+        context "with scheme" do
+          let(:scheme) { "https:" }
+
+          include_examples "embed code youtube example"
         end
 
-        it "does not sanitize embed code" do
-          should eq <<-HTML.strip_heredoc
-            <iframe width="100" height="100" src="https://www.youtube.com/embed/example"></iframe>
-          HTML
+        context "without scheme" do
+          let(:scheme) { "" }
+
+          include_examples "embed code youtube example"
         end
+      end
 
-        context "when url is privacy enhanced mode" do
+      context "with HTML embed code for SlideShare" do
+        shared_examples "embed code slideshare example" do
           let(:markdown) do
             <<-MARKDOWN.strip_heredoc
-              <iframe width="100" height="100" src="https://www.youtube-nocookie.com/embed/example"></iframe>
+              <iframe width="100" height="100" src="#{url}"></iframe>
             MARKDOWN
           end
+          let(:url) { "#{scheme}//www.slideshare.net/embed/example" }
 
-          it "does not sanitize embed code" do
-            should eq <<-HTML.strip_heredoc
-              <iframe width="100" height="100" src="https://www.youtube-nocookie.com/embed/example"></iframe>
-            HTML
+          if allowed
+            it "does not sanitize embed code" do
+              should eq <<-HTML.strip_heredoc
+                <iframe width="100" height="100" src="#{url}"></iframe>
+              HTML
+            end
+          else
+            it "forces width attribute on iframe" do
+              should eq <<-HTML.strip_heredoc
+                <iframe width="100%" height="100" src="#{url}"></iframe>
+              HTML
+            end
           end
         end
-      end
 
-      context "with HTML embed code for SlideShare" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <iframe width="100" height="100" src="https://www.slideshare.net/embed/example"></iframe>
-          MARKDOWN
+        context "with scheme" do
+          let(:scheme) { "https:" }
+
+          include_examples "embed code slideshare example"
         end
 
-        it "does not sanitize embed code" do
-          should eq <<-HTML.strip_heredoc
-            <iframe width="100" height="100" src="https://www.slideshare.net/embed/example"></iframe>
-          HTML
+        context "without scheme" do
+          let(:scheme) { "" }
+
+          include_examples "embed code slideshare example"
         end
       end
 
       context "with HTML embed code for GoogleSlide" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <iframe src="https://docs.google.com/presentation/d/example/embed" frameborder="0" width="482" height="300" allowfullscreen="true" mozallowfullscreen="true" webkitallowfullscreen="true"></iframe>
-          MARKDOWN
+        shared_examples "embed code googleslide example" do
+          let(:markdown) do
+            <<-MARKDOWN.strip_heredoc
+            <iframe src="#{url}" frameborder="0" width="482" height="300" allowfullscreen="true" mozallowfullscreen="true" webkitallowfullscreen="true"></iframe>
+            MARKDOWN
+          end
+          let(:url) { "#{scheme}//docs.google.com/presentation/d/example/embed" }
+
+          if allowed
+            it "does not sanitize embed code" do
+              should eq <<-HTML.strip_heredoc
+              <iframe src="#{url}" frameborder="0" width="482" height="300" allowfullscreen="true"></iframe>
+              HTML
+            end
+          else
+            it "forces width attribute on iframe" do
+              should eq <<-HTML.strip_heredoc
+              <iframe src="#{url}" frameborder="0" width="100%" height="300" allowfullscreen="true"></iframe>
+              HTML
+            end
+          end
         end
 
-        it "does not sanitize embed code" do
-          should eq <<-HTML.strip_heredoc
-            <iframe src="https://docs.google.com/presentation/d/example/embed" frameborder="0" width="482" height="300" allowfullscreen="true"></iframe>
-          HTML
+        context "with scheme" do
+          let(:scheme) { "https:" }
+
+          include_examples "embed code googleslide example"
+        end
+
+        context "without scheme" do
+          let(:scheme) { "" }
+
+          include_examples "embed code googleslide example"
         end
       end
 
@@ -1566,6 +1637,153 @@ describe Qiita::Markdown::Processor do
           HTML
         end
       end
+
+      context "with embed script code with xss" do
+        let(:markdown) do
+          <<-MARKDOWN.strip_heredoc
+            <script async class="speakerdeck-embed" data-id="example" data-ratio="1.33333333333333" src="javascript://speakerdeck.com/assets/embed.js"></script>
+          MARKDOWN
+        end
+
+        if allowed
+          it "does not sanitize embed code" do
+            should eq markdown
+          end
+        else
+          it "forces width attribute on iframe" do
+            should eq "\n"
+          end
+        end
+      end
+
+      context "with embed iframe code with xss" do
+        let(:markdown) do
+          <<-MARKDOWN.strip_heredoc
+            <iframe src="javascript://docs.google.com:80/%0d%0aalert(document.domain)" frameborder="0" width="482" height="300" allowfullscreen="true" mozallowfullscreen="true" webkitallowfullscreen="true"></iframe>
+          MARKDOWN
+        end
+
+        if allowed
+          it "does not sanitize embed code" do
+            should eq <<-HTML.strip_heredoc
+              <iframe src="javascript://docs.google.com:80/%0d%0aalert(document.domain)" frameborder="0" width="482" height="300" allowfullscreen="true"></iframe>
+            HTML
+          end
+        else
+          it "forces width attribute on iframe" do
+            should eq "\n"
+          end
+        end
+      end
+    end
+
+    shared_examples_for "custom block" do |allowed:|
+      context "with custom block" do
+        let(:type) { "" }
+        let(:subtype) { "" }
+
+        let(:markdown) do
+          <<-MARKDOWN.strip_heredoc
+            :::#{[type, subtype].join(' ').rstrip}
+            Some kind of text is here.
+            :::
+          MARKDOWN
+        end
+
+        context "when type is not allowed" do
+          let(:type) { "anytype" }
+
+          if allowed
+            it "returns simple div element" do
+              should eq <<-HTML.strip_heredoc
+                <div data-type="customblock" data-metadata="anytype">Some kind of text is here.
+                </div>
+              HTML
+            end
+          else
+            it "returns simple div element" do
+              should eq <<-HTML.strip_heredoc
+                <div>Some kind of text is here.
+                </div>
+              HTML
+            end
+          end
+        end
+
+        context "when type is message" do
+          let(:type) { "message" }
+
+          context "when subtype is empty" do
+            if allowed
+              it "returns info message block with class including icon as default type" do
+                should eq <<-HTML.strip_heredoc
+                  <div data-type="customblock" data-metadata="message" class="message info">
+                  <span class="fa fa-fw fa-check-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            else
+              it "returns message block with class including icon" do
+                should eq <<-HTML.strip_heredoc
+                  <div class="message info">
+                  <span class="fa fa-fw fa-check-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            end
+          end
+
+          context "when subtype is warn" do
+            let(:subtype) { "warn" }
+
+            if allowed
+              it "returns warning message block with class including icon" do
+                should eq <<-HTML.strip_heredoc
+                  <div data-type="customblock" data-metadata="message warn" class="message warn">
+                  <span class="fa fa-fw fa-exclamation-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            else
+              it "returns message block with class including icon" do
+                should eq <<-HTML.strip_heredoc
+                  <div class="message warn">
+                  <span class="fa fa-fw fa-exclamation-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            end
+          end
+
+          context "when subtype is alert" do
+            let(:subtype) { "alert" }
+
+            if allowed
+              it "returns alerting message block with class including icon" do
+                should eq <<-HTML.strip_heredoc
+                  <div data-type="customblock" data-metadata="message alert" class="message alert">
+                  <span class="fa fa-fw fa-times-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            else
+              it "returns message block with class including icon" do
+                should eq <<-HTML.strip_heredoc
+                  <div class="message alert">
+                  <span class="fa fa-fw fa-times-circle"></span><p>Some kind of text is here.
+                  </p>
+                  </div>
+                HTML
+              end
+            end
+          end
+        end
+      end
     end
 
     context "without script and strict context" do
@@ -1582,6 +1800,7 @@ describe Qiita::Markdown::Processor do
       include_examples "class attribute", allowed: true
       include_examples "background-color", allowed: true
       include_examples "override embed code attributes", allowed: false
+      include_examples "custom block", allowed: false
     end
 
     context "with script context" do
@@ -1598,6 +1817,7 @@ describe Qiita::Markdown::Processor do
       include_examples "class attribute", allowed: true
       include_examples "background-color", allowed: true
       include_examples "override embed code attributes", allowed: true
+      include_examples "custom block", allowed: true
     end
 
     context "with strict context" do
@@ -1614,6 +1834,7 @@ describe Qiita::Markdown::Processor do
       include_examples "class attribute", allowed: false
       include_examples "background-color", allowed: false
       include_examples "override embed code attributes", allowed: false
+      include_examples "custom block", allowed: false
     end
 
     context "with script and strict context" do
@@ -1630,6 +1851,7 @@ describe Qiita::Markdown::Processor do
       include_examples "class attribute", allowed: false
       include_examples "background-color", allowed: false
       include_examples "override embed code attributes", allowed: false
+      include_examples "custom block", allowed: true
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: qiita-markdown
 version: !ruby/object:Gem::Version
-  version: 0.31.0
+  version: 0.36.0
 platform: ruby
 authors:
 - Ryo Nakamura
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-03 00:00:00.000000000 Z
+date: 2021-07-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gemoji
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.5.1.1
+        version: 3.5.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.5.1.1
+        version: 3.5.1.2
 - !ruby/object:Gem::Dependency
   name: sanitize
   requirement: !ruby/object:Gem::Requirement
@@ -258,7 +258,6 @@ files:
 - lib/qiita/markdown/base_processor.rb
 - lib/qiita/markdown/embed/asciinema.rb
 - lib/qiita/markdown/embed/code_pen.rb
-- lib/qiita/markdown/embed/gist.rb
 - lib/qiita/markdown/embed/google_slide.rb
 - lib/qiita/markdown/embed/slide_share.rb
 - lib/qiita/markdown/embed/speeker_deck.rb
@@ -266,6 +265,7 @@ files:
 - lib/qiita/markdown/embed/youtube.rb
 - lib/qiita/markdown/filters/checkbox.rb
 - lib/qiita/markdown/filters/code_block.rb
+- lib/qiita/markdown/filters/custom_block.rb
 - lib/qiita/markdown/filters/emoji.rb
 - lib/qiita/markdown/filters/external_link.rb
 - lib/qiita/markdown/filters/final_sanitizer.rb
@@ -316,7 +316,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.4
 signing_key:
 specification_version: 4
 summary: Qiita-specified markdown processor.

data/lib/qiita/markdown/embed/gist.rb

@@ -1,9 +0,0 @@
-module Qiita
-  module Markdown
-    module Embed
-      module Gist
-        SCRIPT_HOST = "gist.github.com".freeze
-      end
-    end
-  end
-end