Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobert Speicher <rspeicher@gmail.com>2015-05-08 19:17:54 +0300
committerRobert Speicher <rspeicher@gmail.com>2015-05-08 19:31:34 +0300
commit70bbf093aa07d416ea33da24ab015e5d22c0d501 (patch)
tree4ad8957bbc3bd5ad170fc41c194010ea527ea15c /spec/fixtures/markdown.md.erb
parentd9b6b9201e7d4495c28035bf545ee2b85834bd5e (diff)
Remove class and id attributes from SanitizationFilter whitelist
Diffstat (limited to 'spec/fixtures/markdown.md.erb')
-rw-r--r--spec/fixtures/markdown.md.erb26
1 files changed, 12 insertions, 14 deletions
diff --git a/spec/fixtures/markdown.md.erb b/spec/fixtures/markdown.md.erb
index bc023ecf793..64817ec6700 100644
--- a/spec/fixtures/markdown.md.erb
+++ b/spec/fixtures/markdown.md.erb
@@ -54,36 +54,34 @@ After the Markdown has been turned into HTML, it gets passed through...
### SanitizationFilter
-GitLab uses <a href="http://git.io/vfW8a" class="sanitize" id="sanitize-link">HTML::Pipeline::SanitizationFilter</a>
+GitLab uses <a href="http://git.io/vfW8a">HTML::Pipeline::SanitizationFilter</a>
to sanitize the generated HTML, stripping dangerous or unwanted tags.
Its default whitelist is pretty permissive. Check it:
-<b id="manual-b">This text is bold</b> and <em id="manual-em">this text is emphasized</em>.
+<b>b tag</b> and <em>em tag</em>.
-<code id="manual-code">echo "Hello, world!"</code>
+<code>code tag</code>
Press <kbd>s</kbd> to search.
-<strike>Emoji</strike> Plain old images! <img
-src="http://www.emoji-cheat-sheet.com/graphics/emojis/smile.png" width="20"
-height="20" id="manual-img" />
+<strike>Emoji</strike> Plain old images! <img src="http://www.emoji-cheat-sheet.com/graphics/emojis/smile.png" width="20" height="20" />
Here comes a line break:
-<br id="manual-br" />
+<br />
And a horizontal rule:
-<hr id="manual-hr" />
+<hr />
As permissive as it is, we've allowed even more stuff:
-<span class="light" id="span-class-light">Span elements</span>
+<span>span tag</span>
-<a href="#" rel="nofollow" id="a-rel-nofollow">This is a link with a defined rel attribute, which should be removed</a>
+<a href="#" rel="nofollow">This is a link with a defined rel attribute, which should be removed</a>
-<a href="javascript:alert('Hi')" id="a-href-javascript">This is a link trying to be sneaky. It gets its link removed entirely.</a>
+<a href="javascript:alert('Hi')">This is a link trying to be sneaky. It gets its link removed entirely.</a>
### Escaping
@@ -125,9 +123,9 @@ These are all plain text that should get turned into links:
But it shouldn't autolink text inside certain tags:
-- <code id="autolink-code">http://about.gitlab.com/</code>
-- <a id="autolink-a">http://about.gitlab.com/</a>
-- <kbd id="autolink-kbd">http://about.gitlab.com/</kbd>
+- <code>http://about.gitlab.com/</code>
+- <a>http://about.gitlab.com/</a>
+- <kbd>http://about.gitlab.com/</kbd>
### Reference Filters (e.g., #<%= issue.iid %>)