diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2023-06-03 01:07:33 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2023-06-03 01:07:33 +0300 |
commit | 0eb0daa071d5caa34385aba190ba5aece09b1527 (patch) | |
tree | 3e8c447803f0f6456e9ce17956c3727005475fea /lib/banzai/filter/inline_diff_filter.rb | |
parent | f91c598db1bfae546441b87715180b9925a85264 (diff) |
Add latest changes from gitlab-org/security/gitlab@15-11-stable-ee
Diffstat (limited to 'lib/banzai/filter/inline_diff_filter.rb')
-rw-r--r-- | lib/banzai/filter/inline_diff_filter.rb | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/lib/banzai/filter/inline_diff_filter.rb b/lib/banzai/filter/inline_diff_filter.rb index e47ff15e7b7..2a43540934c 100644 --- a/lib/banzai/filter/inline_diff_filter.rb +++ b/lib/banzai/filter/inline_diff_filter.rb @@ -6,6 +6,14 @@ module Banzai class InlineDiffFilter < HTML::Pipeline::Filter IGNORED_ANCESTOR_TAGS = %w(pre code tt).to_set + INLINE_DIFF_DELETION_UNTRUSTED = '(?:\[\-(.*?)\-\]|\{\-(.*?)\-\})' + INLINE_DIFF_DELETION_UNTRUSTED_REGEX = + Gitlab::UntrustedRegexp.new(INLINE_DIFF_DELETION_UNTRUSTED, multiline: false) + + INLINE_DIFF_ADDITION_UNTRUSTED = '(?:\[\+(.*?)\+\]|\{\+(.*?)\+\})' + INLINE_DIFF_ADDITION_UNTRUSTED_REGEX = + Gitlab::UntrustedRegexp.new(INLINE_DIFF_ADDITION_UNTRUSTED, multiline: false) + def call doc.xpath('descendant-or-self::text()').each do |node| next if has_ancestor?(node, IGNORED_ANCESTOR_TAGS) @@ -21,8 +29,13 @@ module Banzai end def inline_diff_filter(text) - html_content = text.gsub(/(?:\[\-(.*?)\-\]|\{\-(.*?)\-\})/, '<span class="idiff left right deletion">\1\2</span>') - html_content.gsub(/(?:\[\+(.*?)\+\]|\{\+(.*?)\+\})/, '<span class="idiff left right addition">\1\2</span>') + html_content = INLINE_DIFF_DELETION_UNTRUSTED_REGEX.replace_gsub(text) do |match| + %(<span class="idiff left right deletion">#{match[1]}#{match[2]}</span>) + end + + INLINE_DIFF_ADDITION_UNTRUSTED_REGEX.replace_gsub(html_content) do |match| + %(<span class="idiff left right addition">#{match[1]}#{match[2]}</span>) + end end end end |