diff options
| author | Yorick Peterse <yorickpeterse@gmail.com> | 2016-08-15 10:02:17 +0000 |
|---|---|---|
| committer | Yorick Peterse <yorickpeterse@gmail.com> | 2016-08-15 10:02:17 +0000 |
| commit | 11c6077441401512ebc100689cf43d9e1d0ca599 (patch) | |
| tree | 9247e662cd68f90fe97a5cc42c0ff2e0d0665eea | |
| parent | 30f5b9a5b711b46f1065baf755e413ceced5646b (diff) | |
| parent | 504a3b5e6f0b2e2957cf1e4d9d8eebbf32234bdb (diff) | |
| download | gitlab-ce-11c6077441401512ebc100689cf43d9e1d0ca599.tar.gz | |
Merge branch 'fix/sanitization-filter-leak' into 'master'
Fix a memory leak caused by Banzai::Filter::SanitizationFilter
See merge request !5808
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | lib/banzai/filter/sanitization_filter.rb | 4 |
2 files changed, 4 insertions, 1 deletions
diff --git a/CHANGELOG b/CHANGELOG index 6e096b480c0..fa9b81d3303 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -108,6 +108,7 @@ v 8.11.0 (unreleased) - Sort folders with submodules in Files view !5521 - Each `File::exists?` replaced to `File::exist?` because of deprecate since ruby version 2.2.0 - Add auto-completition in pipeline (Katarzyna Kobierska Ula Budziszewska) + - Fix a memory leak caused by Banzai::Filter::SanitizationFilter v 8.10.5 - Add a data migration to fix some missing timestamps in the members table. !5670 diff --git a/lib/banzai/filter/sanitization_filter.rb b/lib/banzai/filter/sanitization_filter.rb index ca80aac5a08..6e13282d5f4 100644 --- a/lib/banzai/filter/sanitization_filter.rb +++ b/lib/banzai/filter/sanitization_filter.rb @@ -7,7 +7,7 @@ module Banzai UNSAFE_PROTOCOLS = %w(data javascript vbscript).freeze def whitelist - whitelist = super + whitelist = super.dup customize_whitelist(whitelist) @@ -42,6 +42,8 @@ module Banzai # Allow any protocol in `a` elements... whitelist[:protocols].delete('a') + whitelist[:transformers] = whitelist[:transformers].dup + # ...but then remove links with unsafe protocols whitelist[:transformers].push(remove_unsafe_links) |