diff options
author | Robert Speicher <robert@gitlab.com> | 2017-02-09 20:30:06 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2017-02-15 18:41:57 +0300 |
commit | 7e1f7a02dbe3ebb6688005a4d966670bea12beb1 (patch) | |
tree | a26cbc9c30f5e913831571cd6d01f6cae554c1fc /lib/gitlab/other_markup.rb | |
parent | 33c8d413d2b42bd7b823228a2739eddcd4dfbe51 (diff) |
Merge branch 'fix-rdoc-xss' into 'security'
Fix XSS in rdoc and other markups
See https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2058
Diffstat (limited to 'lib/gitlab/other_markup.rb')
-rw-r--r-- | lib/gitlab/other_markup.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/gitlab/other_markup.rb b/lib/gitlab/other_markup.rb index 4e2f8ed5587..e67acf28c94 100644 --- a/lib/gitlab/other_markup.rb +++ b/lib/gitlab/other_markup.rb @@ -17,6 +17,9 @@ module Gitlab html = Banzai.post_process(html, context) + filter = Banzai::Filter::SanitizationFilter.new(html) + html = filter.call.to_s + html.html_safe end end |