spec/lib/banzai/filter · 8f7266cd4b6a3e65224b55c2b91509f5ac88d837 · Forest Godfrey / gitlab-ce

authored Nov 07, 2016

Fix for HackerOne XSS vulnerability in markdown

This is an updated blacklist patch to fix https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2007. No text is removed. Dangerous schemes/protocols and invalid URIs are left intact but not linked.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23153

See merge request !2015
Signed-off-by: Rémy Coutable <remy@rymai.me>

a14ee68f

Name	Last commit	Last update
..
abstract_link_filter_spec.rb		Loading commit data...
autolink_filter_spec.rb		Loading commit data...
blockquote_fence_filter_spec.rb		Loading commit data...
commit_range_reference_filter_spec.rb		Loading commit data...
commit_reference_filter_spec.rb		Loading commit data...
emoji_filter_spec.rb		Loading commit data...
external_issue_reference_filter_spec.rb		Loading commit data...
external_link_filter_spec.rb		Loading commit data...
gollum_tags_filter_spec.rb		Loading commit data...
html_entity_filter_spec.rb		Loading commit data...
image_link_filter_spec.rb		Loading commit data...
inline_diff_filter_spec.rb		Loading commit data...
issue_reference_filter_spec.rb		Loading commit data...
label_reference_filter_spec.rb		Loading commit data...
merge_request_reference_filter_spec.rb		Loading commit data...
milestone_reference_filter_spec.rb		Loading commit data...
redactor_filter_spec.rb		Loading commit data...
reference_filter_spec.rb		Loading commit data...
relative_link_filter_spec.rb		Loading commit data...
sanitization_filter_spec.rb		Loading commit data...
snippet_reference_filter_spec.rb		Loading commit data...
syntax_highlight_filter_spec.rb		Loading commit data...
table_of_contents_filter_spec.rb		Loading commit data...
upload_link_filter_spec.rb		Loading commit data...
user_reference_filter_spec.rb		Loading commit data...
video_link_filter_spec.rb		Loading commit data...
wiki_link_filter_spec.rb		Loading commit data...
yaml_front_matter_filter_spec.rb		Loading commit data...