76 lines
3.7 KiB
Diff
76 lines
3.7 KiB
Diff
|
From da7aadf928d85ffdf594d7e77aed4a441f7c3ebb Mon Sep 17 00:00:00 2001
|
||
|
|
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||
|
|
Date: Fri, 21 Feb 2025 15:53:31 +0900
|
||
|
|
Subject: [PATCH 2/2] Escape/unescape unclosed tags as well
|
||
|
|
|
||
|
|
Reference:https://github.com/ruby/cgi/commit/da7aadf928d85ffdf594d7e77aed4a441f7c3ebb
|
||
|
|
Conflict:NA
|
||
|
|
|
||
|
|
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
|
||
|
|
---
|
||
|
|
lib/cgi/util.rb | 4 ++--
|
||
|
|
test/cgi/test_cgi_util.rb | 18 ++++++++++++++++++
|
||
|
|
2 files changed, 20 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/lib/cgi/util.rb b/lib/cgi/util.rb
|
||
|
|
index aab8b00..5ff8ba5 100644
|
||
|
|
--- a/lib/cgi/util.rb
|
||
|
|
+++ b/lib/cgi/util.rb
|
||
|
|
@@ -140,7 +140,7 @@ module CGI::Util
|
||
|
|
def escapeElement(string, *elements)
|
||
|
|
elements = elements[0] if elements[0].kind_of?(Array)
|
||
|
|
unless elements.empty?
|
||
|
|
- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do
|
||
|
|
+ string.gsub(/<\/?(?:#{elements.join("|")})\b[^<>]*+>?/im) do
|
||
|
|
CGI.escapeHTML($&)
|
||
|
|
end
|
||
|
|
else
|
||
|
|
@@ -160,7 +160,7 @@ module CGI::Util
|
||
|
|
def unescapeElement(string, *elements)
|
||
|
|
elements = elements[0] if elements[0].kind_of?(Array)
|
||
|
|
unless elements.empty?
|
||
|
|
- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do
|
||
|
|
+ string.gsub(/<\/?(?:#{elements.join("|")})\b(?>[^&]+|&(?![gl]t;)\w+;)*(?:>)?/im) do
|
||
|
|
unescapeHTML($&)
|
||
|
|
end
|
||
|
|
else
|
||
|
|
diff --git a/test/cgi/test_cgi_util.rb b/test/cgi/test_cgi_util.rb
|
||
|
|
index b7bb7b8..e93be47 100644
|
||
|
|
--- a/test/cgi/test_cgi_util.rb
|
||
|
|
+++ b/test/cgi/test_cgi_util.rb
|
||
|
|
@@ -181,6 +181,14 @@ class CGIUtilTest < Test::Unit::TestCase
|
||
|
|
assert_equal("<BR><A HREF="url"></A>", escapeElement('<BR><A HREF="url"></A>', ["A", "IMG"]))
|
||
|
|
assert_equal("<BR><A HREF="url"></A>", escape_element('<BR><A HREF="url"></A>', "A", "IMG"))
|
||
|
|
assert_equal("<BR><A HREF="url"></A>", escape_element('<BR><A HREF="url"></A>', ["A", "IMG"]))
|
||
|
|
+
|
||
|
|
+ assert_equal("<A <A HREF="url"></A>", escapeElement('<A <A HREF="url"></A>', "A", "IMG"))
|
||
|
|
+ assert_equal("<A <A HREF="url"></A>", escapeElement('<A <A HREF="url"></A>', ["A", "IMG"]))
|
||
|
|
+ assert_equal("<A <A HREF="url"></A>", escape_element('<A <A HREF="url"></A>', "A", "IMG"))
|
||
|
|
+ assert_equal("<A <A HREF="url"></A>", escape_element('<A <A HREF="url"></A>', ["A", "IMG"]))
|
||
|
|
+
|
||
|
|
+ assert_equal("<A <A ", escapeElement('<A <A ', "A", "IMG"))
|
||
|
|
+ assert_equal("<A <A ", escapeElement('<A <A ', ["A", "IMG"]))
|
||
|
|
end
|
||
|
|
|
||
|
|
|
||
|
|
@@ -189,5 +197,15 @@ class CGIUtilTest < Test::Unit::TestCase
|
||
|
|
assert_equal('<BR><A HREF="url"></A>', unescapeElement(escapeHTML('<BR><A HREF="url"></A>'), ["A", "IMG"]))
|
||
|
|
assert_equal('<BR><A HREF="url"></A>', unescape_element(escapeHTML('<BR><A HREF="url"></A>'), "A", "IMG"))
|
||
|
|
assert_equal('<BR><A HREF="url"></A>', unescape_element(escapeHTML('<BR><A HREF="url"></A>'), ["A", "IMG"]))
|
||
|
|
+
|
||
|
|
+ assert_equal('<A <A HREF="url"></A>', unescapeElement(escapeHTML('<A <A HREF="url"></A>'), "A", "IMG"))
|
||
|
|
+ assert_equal('<A <A HREF="url"></A>', unescapeElement(escapeHTML('<A <A HREF="url"></A>'), ["A", "IMG"]))
|
||
|
|
+ assert_equal('<A <A HREF="url"></A>', unescape_element(escapeHTML('<A <A HREF="url"></A>'), "A", "IMG"))
|
||
|
|
+ assert_equal('<A <A HREF="url"></A>', unescape_element(escapeHTML('<A <A HREF="url"></A>'), ["A", "IMG"]))
|
||
|
|
+
|
||
|
|
+ assert_equal('<A <A ', unescapeElement(escapeHTML('<A <A '), "A", "IMG"))
|
||
|
|
+ assert_equal('<A <A ', unescapeElement(escapeHTML('<A <A '), ["A", "IMG"]))
|
||
|
|
+ assert_equal('<A <A ', unescape_element(escapeHTML('<A <A '), "A", "IMG"))
|
||
|
|
+ assert_equal('<A <A ', unescape_element(escapeHTML('<A <A '), ["A", "IMG"]))
|
||
|
|
end
|
||
|
|
end
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|
||
|
|
|