Skip to content

Commit 7cecf1e

Browse files
committed
1 parent 1ad2dd3 commit 7cecf1e

File tree

2 files changed

+30
-7
lines changed

2 files changed

+30
-7
lines changed

lib/rdoc/markup/to_html.rb

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ def init_link_notation_regexp_handlings
8484
def handle_RDOCLINK url # :nodoc:
8585
case url
8686
when /^rdoc-ref:/
87-
$'
87+
CGI.escapeHTML($')
8888
when /^rdoc-label:/
8989
text = $'
9090

@@ -95,13 +95,11 @@ def handle_RDOCLINK url # :nodoc:
9595
else text
9696
end
9797

98-
gen_url url, text
98+
gen_url CGI.escapeHTML(url), CGI.escapeHTML(text)
9999
when /^rdoc-image:/
100-
"<img src=\"#{$'}\">"
101-
else
102-
url =~ /\Ardoc-[a-z]+:/
103-
104-
$'
100+
%[<img src=\"#{CGI.escapeHTML($')}\">]
101+
when /\Ardoc-[a-z]+:/
102+
CGI.escapeHTML($')
105103
end
106104
end
107105

test/rdoc/test_rdoc_markup_to_html.rb

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -665,6 +665,26 @@ def test_convert_RDOCLINK_ref
665665
assert_equal "\n<p>C</p>\n", result
666666
end
667667

668+
def test_convert_RDOCLINK_escape_image
669+
assert_escaped '<script>', 'rdoc-image:"><script>alert(`rdoc-image`)</script>"'
670+
end
671+
672+
def test_convert_RDOCLINK_escape_label_id
673+
assert_escaped '<script>', 'rdoc-label::path::"><script>alert(`rdoc-label_id`)</script>"'
674+
end
675+
676+
def test_convert_RDOCLINK_escape_label_path
677+
assert_escaped '<script>', 'rdoc-label::"><script>alert(`rdoc-label_path`)</script>"'
678+
end
679+
680+
def test_convert_RDOCLINK_escape_ref
681+
assert_escaped '<script>', 'rdoc-ref:"><script>alert(`rdoc-ref`)</script>"'
682+
end
683+
684+
def test_convert_RDOCLINK_escape_xxx
685+
assert_escaped '<script>', 'rdoc-xxx:"><script>alert(`rdoc-xxx`)</script>"'
686+
end
687+
668688
def test_convert_TIDYLINK_footnote
669689
result = @to.convert 'text{*1}[rdoc-label:foottext-1:footmark-1]'
670690

@@ -690,6 +710,11 @@ def test_convert_TIDYLINK_image
690710
"\n<p><a href=\"http://example.com\"><img src=\"path/to/image.jpg\"></a></p>\n"
691711

692712
assert_equal expected, result
713+
714+
result =
715+
@to.convert '{rdoc-image:<script>alert`link text`</script>}[http://example.com]'
716+
717+
assert_not_include result, "<script>"
693718
end
694719

695720
def test_convert_TIDYLINK_rdoc_label

0 commit comments

Comments
 (0)