Save and use actual diff base commit for MR diff highlighting

3 files changed, 25 insertions, 9 deletions

diff --git a/lib/gitlab/diff/file.rb b/lib/gitlab/diff/file.rb
index 74b1c117129..a484177ae33 100644
--- a/lib/gitlab/diff/file.rb
+++ b/lib/gitlab/diff/file.rb
@@ -1,14 +1,22 @@
 module Gitlab
   module Diff
     class File
-      attr_reader :diff, :new_ref, :old_ref
+      attr_reader :diff, :diff_refs
 
       delegate :new_file, :deleted_file, :renamed_file,
         :old_path, :new_path, to: :diff, prefix: false
 
       def initialize(diff, diff_refs)
         @diff = diff
-        @old_ref, @new_ref = diff_refs
+        @diff_refs = diff_refs
+      end
+
+      def old_ref
+        diff_refs[0] if diff_refs
+      end
+
+      def new_ref
+        diff_refs[1] if diff_refs
       end
 
       # Array of Gitlab::DIff::Line objects
diff --git a/lib/gitlab/diff/highlight.rb b/lib/gitlab/diff/highlight.rb
index b6875f07279..fe084a7399a 100644
--- a/lib/gitlab/diff/highlight.rb
+++ b/lib/gitlab/diff/highlight.rb
@@ -31,6 +31,8 @@ module Gitlab
       private
 
       def highlight_line(diff_line, index)
+        return html_escape(diff_line.text) unless diff_file.diff_refs
+
         line_prefix = diff_line.text.match(/\A([+-])/) ? $1 : ' '
 
         case diff_line.type
@@ -42,7 +44,7 @@ module Gitlab
 
         # Only update text if line is found. This will prevent
         # issues with submodules given the line only exists in diff content.
-        rich_line ? line_prefix + rich_line : diff_line.text
+        rich_line ? line_prefix + rich_line : html_escape(diff_line.text)
       end
 
       def inline_diffs
@@ -63,6 +65,11 @@ module Gitlab
 
         [ref.project.repository, ref.id, path]
       end
+
+      def html_escape(str)
+        replacements = { '&' => '&amp;', '>' => '&gt;', '<' => '&lt;', '"' => '&quot;', "'" => '&#39;' }
+        str.gsub(/[&"'><]/, replacements)
+      end
     end
   end
 end
diff --git a/lib/gitlab/diff/inline_diff_marker.rb b/lib/gitlab/diff/inline_diff_marker.rb
index c31149d374e..7ca198eeb86 100644
--- a/lib/gitlab/diff/inline_diff_marker.rb
+++ b/lib/gitlab/diff/inline_diff_marker.rb
@@ -9,17 +9,18 @@ module Gitlab
       end
 
       def mark(line_inline_diffs)
-        offset = 0
+        marker_ranges = []
         line_inline_diffs.each do |inline_diff_range|
           # Map the inline-diff range based on the raw line to character positions in the rich line
           inline_diff_positions = position_mapping[inline_diff_range].flatten
           # Turn the array of character positions into ranges
-          marker_ranges = collapse_ranges(inline_diff_positions)
+          marker_ranges.concat(collapse_ranges(inline_diff_positions))
+        end
 
-          # Mark each range
-          marker_ranges.each do |range|
-            offset = insert_around_range(rich_line, range, "<span class='idiff'>", "</span>", offset)
-          end
+        offset = 0
+        # Mark each range
+        marker_ranges.each do |range|
+          offset = insert_around_range(rich_line, range, "<span class='idiff'>", "</span>", offset)
         end
 
         rich_line