From 443e8520918e26155b39bf2fdd98103ce2607258 Mon Sep 17 00:00:00 2001 From: Mac Siri Date: Wed, 11 Aug 2021 10:48:07 -0400 Subject: [PATCH] Remove button from allowed tags (#14434) --- app/sanitizers/rendered_markdown_scrubber.rb | 2 +- spec/services/markdown_processor/parser_spec.rb | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/app/sanitizers/rendered_markdown_scrubber.rb b/app/sanitizers/rendered_markdown_scrubber.rb index 1390be74b..cbf1e3b91 100644 --- a/app/sanitizers/rendered_markdown_scrubber.rb +++ b/app/sanitizers/rendered_markdown_scrubber.rb @@ -4,7 +4,7 @@ class RenderedMarkdownScrubber < Rails::Html::PermitScrubber super self.tags = %w[ - a abbr add b blockquote br button center cite code col colgroup dd del dl dt em figcaption + a abbr add b blockquote br center cite code col colgroup dd del dl dt em figcaption h1 h2 h3 h4 h5 h6 hr img kbd li mark ol p pre q rp rt ruby small source span strong sub sup table tbody td tfoot th thead time tr u ul video ] diff --git a/spec/services/markdown_processor/parser_spec.rb b/spec/services/markdown_processor/parser_spec.rb index d4257347d..910f59efe 100644 --- a/spec/services/markdown_processor/parser_spec.rb +++ b/spec/services/markdown_processor/parser_spec.rb @@ -22,6 +22,11 @@ RSpec.describe MarkdownProcessor::Parser, type: :service do expect(generate_and_parse_markdown(code_block)).to include("{% raw %}", "{% endraw %}") end + it "does not allow button tag" do + button = "" + expect(generate_and_parse_markdown(button)).not_to include("button") + end + it "does not render the escaped dashes when using a `raw` Liquid tag in codeblocks with syntax highlighting" do code_block = "```js\n{% raw %}some text{% endraw %}\n```" expect(generate_and_parse_markdown(code_block)).not_to include("----")