diff options
| author | Stan Hu <stanhu@gmail.com> | 2015-09-12 20:54:06 -0700 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2016-02-01 18:25:32 +0100 |
| commit | f86ddfd36538667cd0c484a62825569a36ef2a2c (patch) | |
| tree | c8d68ea4b84324f974db7671ccba13b754ad4b6f /app/helpers/blob_helper.rb | |
| parent | da8e0f86595299740a344309cb5963854b61c4a6 (diff) | |
| download | gitlab-ce-f86ddfd36538667cd0c484a62825569a36ef2a2c.tar.gz | |
Render sanitized SVG images
Closes https://github.com/gitlabhq/gitlabhq/issues/9265
Diffstat (limited to 'app/helpers/blob_helper.rb')
| -rw-r--r-- | app/helpers/blob_helper.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb index 694c03206bd..16967927922 100644 --- a/app/helpers/blob_helper.rb +++ b/app/helpers/blob_helper.rb @@ -126,4 +126,16 @@ module BlobHelper blob.size end end + + def blob_svg?(blob) + blob.language && blob.language.name == 'SVG' + end + + # SVGs can contain malicious JavaScript; only include whitelisted + # elements and attributes. Note that this whitelist is by no means complete + # and may omit some elements. + def sanitize_svg(blob) + blob.data = Loofah.scrub_fragment(blob.data, :strip).to_xml + blob + end end |