Remove class and id attributes from SanitizationFilter whitelistrs-disallow-id-class

1 files changed, 17 insertions, 2 deletions

diff --git a/lib/gitlab/markdown/sanitization_filter.rb b/lib/gitlab/markdown/sanitization_filter.rb
index 9a154e0b2fe..6f33155badf 100644
--- a/lib/gitlab/markdown/sanitization_filter.rb
+++ b/lib/gitlab/markdown/sanitization_filter.rb
@@ -10,8 +10,9 @@ module Gitlab
       def whitelist
         whitelist = HTML::Pipeline::SanitizationFilter::WHITELIST
 
-        # Allow `class` and `id` on all elements
-        whitelist[:attributes][:all].push('class', 'id')
+        # Allow code highlighting
+        whitelist[:attributes]['pre'] = %w(class)
+        whitelist[:attributes]['span'] = %w(class)
 
         # Allow table alignment
         whitelist[:attributes]['th'] = %w(style)
@@ -23,6 +24,9 @@ module Gitlab
         # Remove `rel` attribute from `a` elements
         whitelist[:transformers].push(remove_rel)
 
+        # Remove `class` attribute from non-highlight spans
+        whitelist[:transformers].push(clean_spans)
+
         whitelist
       end
 
@@ -33,6 +37,17 @@ module Gitlab
           end
         end
       end
+
+      def clean_spans
+        lambda do |env|
+          return unless env[:node_name] == 'span'
+          return unless env[:node].has_attribute?('class')
+
+          unless has_ancestor?(env[:node], 'pre')
+            env[:node].remove_attribute('class')
+          end
+        end
+      end
     end
   end
 end