jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

make sure that markdown uses safe mode (#2961)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-19 23:07:27 +01:00
committed by GitHub
parent 9470699798
commit 76e09447c8
4 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Twig/Runtime/MarkdownExtension.php
View File

@@ -61,7 +61,7 @@ final class MarkdownExtension implements RuntimeExtensionInterface
}
if ($this->isMarkdownEnabled()) {
$content = $this->markdown->toHtml($content, false);
$content = $this->markdown->toHtml($content);
} elseif ($fullLength) {
$content = '<p>' . nl2br($content) . '</p>';
}
@@ -112,7 +112,7 @@ final class MarkdownExtension implements RuntimeExtensionInterface
}
if ($this->isMarkdownEnabled()) {
return $this->markdown->toHtml($content, false);
return $this->markdown->toHtml($content);
}
return nl2br($content);
@@ -126,6 +126,6 @@ final class MarkdownExtension implements RuntimeExtensionInterface
*/
public function markdownToHtml(string $content): string
{
return $this->markdown->toHtml($content, false);
return $this->markdown->toHtml($content);
}
}

7
src/Utils/Markdown.php
View File

@@ -33,7 +33,12 @@ final class Markdown
*/
public function toHtml(string $text, bool $safe = true): string
{
$this->parser->setSafeMode($safe);
if ($safe !== true) {
@trigger_error('Only safe mode is supported in Markdown since 1.16.3 to prevent XSS attacks. Parameter $safe will be removed with 2.0', E_USER_DEPRECATED);
}
$this->parser->setSafeMode(true);
$this->parser->setMarkupEscaped(true);
return $this->parser->text($text);
}