Skip to content

Commit ac35485

Browse files
committed
Escape HYPERLINKs
1 parent 7cecf1e commit ac35485

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

lib/rdoc/markup/to_html.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ def handle_regexp_HARD_BREAK target
123123
# Reference to a local file relative to the output directory.
124124

125125
def handle_regexp_HYPERLINK(target)
126-
url = target.text
126+
url = CGI.escapeHTML(target.text)
127127

128128
gen_url url, url
129129
end

test/rdoc/test_rdoc_markup_to_html.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -836,6 +836,11 @@ def test_handle_regexp_HYPERLINK_irc
836836
assert_equal '<a href="irc://irc.freenode.net/#ruby-lang">irc.freenode.net/#ruby-lang</a>', link
837837
end
838838

839+
def test_handle_regexp_HYPERLINK_escape
840+
code = 'irc://irc.freenode.net/"><script>alert(`irc`)</script><a"'
841+
assert_escaped '<script>', code
842+
end
843+
839844
def test_list_verbatim_2
840845
str = "* one\n verb1\n verb2\n* two\n"
841846

0 commit comments

Comments
 (0)