qiita-markdown 0.23.0 → 0.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 16c43409c5b2bdceefb568344cf9280e7d1e50b2
-  data.tar.gz: f4225f554071f1e8c8c339248f08b3ef5253be46
+  metadata.gz: 2ebf4b7bf3373510614a5718e5f679f8b811e799
+  data.tar.gz: e8c155ed67938804d750f6dbf19ee2dbde25f68f
 SHA512:
-  metadata.gz: 5a9edc2d4826bfefd294ad32cf556fbb6985ac94d4e91a435a9513f6aec51c1a58bc435eebd45350e275ad1e5314c188c0e56bd3d56bc6130d9fcbe18f72ba6e
-  data.tar.gz: 2da9ab1ee70db812a391875522e53606991f177d1f66b7da80192b9db1bbda9cc83d101cb6b01fd292c6dc405b35ccac4cc01a694d7f872b9e7ae5b01bc19155
+  metadata.gz: 0b9770f4cc579ccbb39b7e6b3b4d624937f7e12572bbdaa8db7e2d634439441c4f87b9a5a314a52d10647dd19279d2e5589c6781d161e1368993849590753ba2
+  data.tar.gz: 9ee149a5fc1470e7d7a3e8dca59b2a4cc9fc8765f7494f8703e33222a24811275be35d544fdc520bd092c1607f7951ca6fd1befd3c19919d2dfe9c0187906254

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## Unreleased
 
+## 0.24.0
+
+- Fix to strip HTML tags in ToC
+- Allow to use data-\* attributes when embedding Tweet and CodePen
+
 ## 0.23.0
 
 - Support embed Tweet

data/lib/qiita/markdown/embed/code_pen.rb

@@ -3,7 +3,15 @@ module Qiita
     module Embed
       module CodePen
         SCRIPT_URL = "https://production-assets.codepen.io/assets/embed/ei.js"
-        ATTRIBUTES = %w[class data-embed-version data-slug-hash]
+        CLASS_NAME = %w[codepen]
+        DATA_ATTRIBUTES = %w[
+          data-active-link-color data-active-tab-color data-animations data-border
+          data-border-color data-class data-custom-css-url data-default-tab
+          data-embed-version data-height data-link-logo-color data-pen-title
+          data-preview data-rerun-position data-show-tab-bar data-slug-hash
+          data-tab-bar-color data-tab-link-color data-theme-id data-user
+        ]
+        ATTRIBUTES = %w[class] + DATA_ATTRIBUTES
       end
     end
   end

data/lib/qiita/markdown/embed/tweet.rb

@@ -4,6 +4,11 @@ module Qiita
       module Tweet
         SCRIPT_URL = "https://platform.twitter.com/widgets.js"
         CLASS_NAME = %w[twitter-tweet]
+        DATA_ATTRIBUTES = %w[
+          data-align data-cards data-conversation data-dnt
+          data-id data-lang data-link-color data-theme data-width
+        ]
+        ATTRIBUTES = %w[class] + DATA_ATTRIBUTES
       end
     end
   end

data/lib/qiita/markdown/filters/final_sanitizer.rb

@@ -18,6 +18,7 @@ module Qiita
               "href",
               "rel",
             ],
+            "blockquote" => Embed::Tweet::ATTRIBUTES,
             "iframe" => [
               "allowfullscreen",
               "frameborder",

data/lib/qiita/markdown/filters/user_input_sanitizer.rb

@@ -11,7 +11,7 @@ module Qiita
           ],
           attributes: {
             "a"          => %w[class href rel title],
-            "blockquote" => %w[cite class],
+            "blockquote" => %w[cite] + Embed::Tweet::ATTRIBUTES,
             "code"       => %w[data-metadata],
             "div"        => %w[class],
             "font"       => %w[color],

data/lib/qiita/markdown/greenmat/html_toc_renderer.rb

@@ -65,6 +65,12 @@ module Qiita
           def increment
             counter[id] += 1
           end
+
+          private
+
+          def body
+            escape_html? ? CGI.escape_html(text) : raw_body
+          end
         end
       end
     end

data/lib/qiita/markdown/transformers/filter_attributes.rb

@@ -15,7 +15,7 @@ module Qiita
             "class" => %w[footnotes],
           },
           "p" => {
-            "class" => %w[codepen],
+            "class" => Embed::CodePen::CLASS_NAME,
           },
           "sup" => {
             "id" => /\Afnref\d+\z/,

data/lib/qiita/markdown/version.rb

@@ -1,5 +1,5 @@
 module Qiita
   module Markdown
-    VERSION = "0.23.0"
+    VERSION = "0.24.0"
   end
 end

data/spec/qiita/markdown/greenmat/html_toc_renderer_spec.rb

@@ -117,20 +117,40 @@ describe Qiita::Markdown::Greenmat::HTMLToCRenderer do
   context "with :escape_html extension" do
     let(:extension) { { escape_html: true } }
 
-    let(:markdown) do
-      <<-EOS.strip_heredoc
-        # <b>R&amp;B</b>
-      EOS
+    context "with heading title including HTML tags" do
+      let(:markdown) do
+        <<-EOS.strip_heredoc
+          # <b>R&amp;B</b>
+        EOS
+      end
+
+      it "strips HTML characters in heading title" do
+        should eq <<-EOS.strip_heredoc
+          <ul>
+          <li>
+          <a href="#rb">R&amp;B</a>
+          </li>
+          </ul>
+        EOS
+      end
     end
 
-    it "escapes special HTML characters in heading title" do
-      should eq <<-EOS.strip_heredoc
-        <ul>
-        <li>
-        <a href="#rb">&lt;b&gt;R&amp;amp;B&lt;/b&gt;</a>
-        </li>
-        </ul>
-      EOS
+    context "with heading title including HTML tags inside of code" do
+      let(:markdown) do
+        <<-EOS.strip_heredoc
+          # `<div>`
+        EOS
+      end
+
+      it "escapes HTML tags inside of code" do
+        should eq <<-EOS.strip_heredoc
+          <ul>
+          <li>
+          <a href="#div">&lt;div&gt;</a>
+          </li>
+          </ul>
+        EOS
+      end
     end
   end
 end

data/spec/qiita/markdown/processor_spec.rb

@@ -1162,6 +1162,28 @@ describe Qiita::Markdown::Processor do
         end
       end
 
+      context "with data-attributes for <blockquote> tag" do
+        let(:markdown) do
+          <<-EOS.strip_heredoc
+            <blockquote data-theme="a" data-malicious="b"></blockquote>
+          EOS
+        end
+
+        if allowed
+          it "does not sanitize data-attributes" do
+            should eq <<-EOS.strip_heredoc
+              <blockquote data-theme="a" data-malicious="b"></blockquote>
+            EOS
+          end
+        else
+          it "sanitizes data-attributes except the attributes used by tweet" do
+            should eq <<-EOS.strip_heredoc
+              <blockquote data-theme="a"></blockquote>
+            EOS
+          end
+        end
+      end
+
       context "with data-attributes for <p> tag" do
         let(:markdown) do
           <<-EOS.strip_heredoc
@@ -1329,9 +1351,9 @@ describe Qiita::Markdown::Processor do
             EOS
           end
         else
-          it "sanitizes data-attributes except the minimum attributes and force async attribute" do
+          it "forces async attribute on script" do
             should eq <<-EOS.strip_heredoc
-              <p data-slug-hash="foo" data-embed-version="2" class="codepen"></p>\n
+              <p data-height="1" data-theme-id="0" data-slug-hash="foo" data-default-tab="bar" data-user="baz" data-embed-version="2" data-pen-title="qux" class="codepen"></p>\n
               <script src="https://production-assets.codepen.io/assets/embed/ei.js" async="async"></script>
             EOS
           end
@@ -1341,25 +1363,16 @@ describe Qiita::Markdown::Processor do
       context "with embed code for Tweet" do
         let(:markdown) do
           <<-EOS.strip_heredoc
-            <blockquote class="twitter-tweet" data-cards="hidden" data-conversation="none">foo</blockquote>
+            <blockquote class="twitter-tweet" data-lang="es" data-cards="hidden" data-conversation="none">foo</blockquote>
             <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
           EOS
         end
 
-        if allowed
-          it "does not sanitize embed code" do
-            should eq <<-EOS.strip_heredoc
-              <blockquote class="twitter-tweet" data-cards="hidden" data-conversation="none">foo</blockquote>\n
-              <script async src="https://platform.twitter.com/widgets.js"></script>
-            EOS
-          end
-        else
-          it "sanitizes attributes except `twitter-tweet` class" do
-            should eq <<-EOS.strip_heredoc
-              <blockquote class="twitter-tweet">foo</blockquote>\n
-              <script async src="https://platform.twitter.com/widgets.js"></script>
-            EOS
-          end
+        it "does not sanitize embed code" do
+          should eq <<-EOS.strip_heredoc
+            <blockquote class="twitter-tweet" data-lang="es" data-cards="hidden" data-conversation="none">foo</blockquote>\n
+            <script async src="https://platform.twitter.com/widgets.js"></script>
+          EOS
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: qiita-markdown
 version: !ruby/object:Gem::Version
-  version: 0.23.0
+  version: 0.24.0
 platform: ruby
 authors:
 - Ryo Nakamura
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-09 00:00:00.000000000 Z
+date: 2017-12-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gemoji