Merge branch 'security-bw-confidential-titles-through-markdown-api-11-3' into 'security-11-3'

[11.3] Confidential issue/private snippet titles can be read by unauthenticated user through GFM markdown API

See merge request gitlab/gitlabhq!2535

2 files changed, 10 insertions, 4 deletions

diff --git a/lib/api/markdown.rb b/lib/api/markdown.rb
index 5d55224c1a7..09a8c34c5c0 100644
--- a/lib/api/markdown.rb
+++ b/lib/api/markdown.rb
@@ -10,7 +10,8 @@ module API
         detail "This feature was introduced in GitLab 11.0."
       end
       post do
-        context = { only_path: false }
+        context = { only_path: false, current_user: current_user }
+        context[:pipeline] = params[:gfm] ? :full : :plain_markdown
 
         if params[:project]
           project = Project.find_by_full_path(params[:project])
@@ -22,9 +23,7 @@ module API
           context[:skip_project_check] = true
         end
 
-        context[:pipeline] = params[:gfm] ? :full : :plain_markdown
-
-        { html: Banzai.render(params[:text], context) }
+        { html: Banzai.render_and_post_process(params[:text], context) }
       end
     end
   end
diff --git a/lib/banzai.rb b/lib/banzai.rb
index 5df98f66f3b..788f29a6c08 100644
--- a/lib/banzai.rb
+++ b/lib/banzai.rb
@@ -1,4 +1,11 @@
 module Banzai
+  # if you need to render markdown, then you probably need to post_process as well,
+  # such as removing references that the current user doesn't have
+  # permission to make
+  def self.render_and_post_process(text, context = {})
+    post_process(render(text, context), context)
+  end
+
   def self.render(text, context = {})
     Renderer.render(text, context)
   end