Changeset 131 for trunk/lib/redcloth/base.rb

Timestamp:

01/17/2007 14:37:42 (22 months ago)

Author:

jgarber

Message:

Fix :filter_html restriction. Closes #7 and fixes the bug exposed in [115].

Files:

• trunk/lib/redcloth/base.rb (modified) (6 diffs)

trunk/lib/redcloth/base.rb

@@ -123 +123 @@
         no_textile text
         rip_offtags text
+        clean_html text if filter_html
         hard_break text
         unless @lite_mode
@@ -129 +130 @@
         end
         inline text
+
+        escape_html_except_tags text if filter_html
+
         smooth_offtags text
         retrieve text
@@ -134 +138 @@
         post_process text
         DEFAULT_RULES.each {|ruleset| send("#{ruleset}_post_process", text) if private_methods.include? "#{ruleset}_post_process"}
-
-        clean_html text if filter_html
 
         return text.strip
@@ -383 +385 @@
     # Flexible HTML escaping
     #
-    def htmlesc( str, mode )
+    def htmlesc( str, mode=nil )
         str.gsub!( '&', '&' )
         str.gsub!( '"', '"' ) if mode != :NoQuotes
@@ -627 +629 @@
         'blockquote' => ['cite']
     }
-
-    def clean_html( text, tags = BASIC_TAGS )
+    
+    # Which tags to accept as input when :filter_html is on
+    ALLOWED_INCOMING_TAGS = {
+        'kbd' => nil,
+        'code' => ['lang'],
+        'notextile' => nil, 
+        'pre' => nil
+    }
+
+    # Escape unauthorized tags
+    def clean_html( text, allowed_tags = ALLOWED_INCOMING_TAGS )
         text.gsub!( /<!\[CDATA\[/, '' )
-        text.gsub!( /<(\/*)(\w+)([^>]*)>/ ) do
+        text.gsub!( /<(\/*)([A-Za-z]\w*)([^>]*)>/ ) do |m|
             raw = $~
             tag = raw[2].downcase
-            if tags.has_key? tag
+            if m =~ /<redpre#\d+>/
+              m # return internal pre markers untouched
+            elsif allowed_tags.has_key? tag
                 pcs = [tag]
-                tags[tag].each do |prop|
+                allowed_tags[tag].each do |prop|
                     ['"', "'", ''].each do |q|
                         q2 = ( q != '' ? q : '\s' )
@@ -645 +658 @@
                         end
                     end
-                end if tags[tag]
+                end if allowed_tags[tag]
                 "<#{raw[1]}#{pcs.join " "}>"
             else
-                " "
+                htmlesc(m) # gsub!s m
+                m
             end
         end
+    end
+    
+    def escape_html_except_tags(text)
+      text.gsub!(/
+          ( <!-- (?m:.*?) -->
+            | <\/? 
+              [A-Za-z]\w*\b                               # Tags start with a letter and
+              (?:<\d+>|[^>"']|"[^"]*"|'[^']*')* >         # can have shelved items or attributes.
+            | &(?:[a-zA-Z0-9]+|\#[0-9]+|\#x[0-9a-fA-F]+); # Existing entity.
+          )
+          |([^<&]+|[<&])
+
+        /x) do |m|
+          if $2
+            htmlesc(m)
+            m
+          else
+            m
+          end
+      end
     end