コミット: a490e18e37df8ccc60eb566731d82e4d2ebf937a - allura (git)

allura

コミットメタ情報

• リビジョン: a490e18e37df8ccc60eb566731d82e4d2ebf937a (tree)
• 日時: 2012-01-25 14:38:25
• 作者: Dave Brondsema <dbrondsema@geek...>
• コミッター: Dave Brondsema

ログメッセージ

[#3643] make readme rendering of plaintext safe

Signed-off-by: Dave Brondsema <[e-mail]>

変更サマリ

• modified: Allura/allura/lib/helpers.py
• modified: Allura/allura/templates/repo/tree.html
• modified: Allura/allura/tests/test_helpers.py

差分

--- a/Allura/allura/lib/helpers.py
+++ b/Allura/allura/lib/helpers.py
@@ -25,6 +25,7 @@ from pylons import c, response, request
 from tg.decorators import before_validate
 from formencode.variabledecode import variable_decode
 import formencode
+from jinja2 import Markup
 
 from webhelpers import date, feedgenerator, html, number, misc, text
 
@@ -541,12 +542,14 @@ def paging_sanitizer(limit, page, total_count, zero_based_pages=True):
     return limit, page
 
 def render_any_markup(name, text):
+    """
+    renders any markup format using the pypeline
+    Returns jinja-safe text
+    """
     if text == '':
         text = '<p><em>Empty File</em></p>'
     else:
-        renderer = pylons.g.pypeline_markup.renderer(name)
-        if renderer[1]:
-            text = pylons.g.pypeline_markup.render(name,text)
-        else:
+        text = pylons.g.pypeline_markup.render(name, text)
+        if not pylons.g.pypeline_markup.can_render(name):
             text = '<pre>%s</pre>' % text
-    return text
\ No newline at end of file
+    return Markup(text)
\ No newline at end of file

--- a/Allura/allura/templates/repo/tree.html
+++ b/Allura/allura/templates/repo/tree.html
@@ -27,6 +27,6 @@ Tree <a href="{{commit.url()}}">{{commit.shorthand_id()}}</a> {{commit_labels(co
 {% set name, text = tree.readme() %}
 {% if name %}
   <h1 id="readme">Read Me</h1>
-  {{h.render_any_markup(name, text)|safe}}
+  {{h.render_any_markup(name, text)}}
 {% endif %}
 {% endblock %}

--- a/Allura/allura/tests/test_helpers.py
+++ b/Allura/allura/tests/test_helpers.py
@@ -114,5 +114,14 @@ def test_paging_sanitizer():
     for input, output in test_data.iteritems():
         assert (h.paging_sanitizer(*input)) == output
 
-def test_render_any_markup():
-    pass
\ No newline at end of file
+def test_render_any_markup_empty():
+    assert_equals(h.render_any_markup('foo', ''), '<p><em>Empty File</em></p>')
+
+def test_render_any_markup_plain():
+    assert_equals(h.render_any_markup('readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo'),
+                  '<pre>&lt;b&gt;blah&lt;/b&gt;\n&lt;script&gt;alert(1)&lt;/script&gt;\nfoo</pre>')
+
+def test_render_any_markup_formatting():
+    assert_equals(h.render_any_markup('README.md', '### foo\n<script>alert(1)</script> bar'),
+                  '<h3>foo</h3>\n<p>&lt;script&gt;alert(1)&lt;/script&gt; bar</p>')
+