Merge branch 'issue-63298-asciidoc-sanitization' into 'master'

Prevent excessive sanitization of AsciiDoc ouptut

Closes #63298

See merge request gitlab-org/gitlab-ce!30290

1 files changed, 94 insertions, 5 deletions

diff --git a/spec/lib/gitlab/asciidoc_spec.rb b/spec/lib/gitlab/asciidoc_spec.rb
index 8f2434acd26..ff002acbd35 100644
--- a/spec/lib/gitlab/asciidoc_spec.rb
+++ b/spec/lib/gitlab/asciidoc_spec.rb
@@ -45,28 +45,117 @@ module Gitlab
       end
 
       context "XSS" do
-        links = {
-          'links' => {
+        items = {
+          'link with extra attribute' => {
             input: 'link:mylink"onmouseover="alert(1)[Click Here]',
             output: "<div>\n<p><a href=\"mylink\">Click Here</a></p>\n</div>"
           },
-          'images' => {
+          'link with unsafe scheme' => {
+              input: 'link:data://danger[Click Here]',
+              output: "<div>\n<p><a>Click Here</a></p>\n</div>"
+          },
+          'image with onerror' => {
             input: 'image:https://localhost.com/image.png[Alt text" onerror="alert(7)]',
             output: "<div>\n<p><span><img src=\"https://localhost.com/image.png\" alt='Alt text\" onerror=\"alert(7)'></span></p>\n</div>"
           },
-          'pre' => {
+          'fenced code with inline script' => {
             input: '```mypre"><script>alert(3)</script>',
             output: "<div>\n<div>\n<pre class=\"code highlight js-syntax-highlight plaintext\" lang=\"plaintext\" v-pre=\"true\"><code><span id=\"LC1\" class=\"line\" lang=\"plaintext\">\"&gt;</span></code></pre>\n</div>\n</div>"
           }
         }
 
-        links.each do |name, data|
+        items.each do |name, data|
           it "does not convert dangerous #{name} into HTML" do
             expect(render(data[:input], context)).to include(data[:output])
           end
         end
       end
 
+      context 'with admonition' do
+        it 'preserves classes' do
+          input = <<~ADOC
+            NOTE: An admonition paragraph, like this note, grabs the reader’s attention.
+          ADOC
+
+          output = <<~HTML
+            <div class="admonitionblock">
+            <table>
+            <tr>
+            <td class="icon">
+            <i class="fa icon-note" title="Note"></i>
+            </td>
+            <td>
+            An admonition paragraph, like this note, grabs the reader’s attention.
+            </td>
+            </tr>
+            </table>
+            </div>
+          HTML
+
+          expect(render(input, context)).to include(output.strip)
+        end
+      end
+
+      context 'with checklist' do
+        it 'preserves classes' do
+          input = <<~ADOC
+            * [x] checked
+            * [ ] not checked
+          ADOC
+
+          output = <<~HTML
+            <div>
+            <ul class="checklist">
+            <li>
+            <p><i class="fa fa-check-square-o"></i> checked</p>
+            </li>
+            <li>
+            <p><i class="fa fa-square-o"></i> not checked</p>
+            </li>
+            </ul>
+            </div>
+          HTML
+
+          expect(render(input, context)).to include(output.strip)
+        end
+      end
+
+      context 'with marks' do
+        it 'preserves classes' do
+          input = <<~ADOC
+            Werewolves are allergic to #cassia cinnamon#.
+
+            Did the werewolves read the [.small]#small print#?
+
+            Where did all the [.underline.small]#cores# run off to?
+
+            We need [.line-through]#ten# make that twenty VMs.
+
+            [.big]##O##nce upon an infinite loop.
+          ADOC
+
+          output = <<~HTML
+            <div>
+            <p>Werewolves are allergic to <mark>cassia cinnamon</mark>.</p>
+            </div>
+            <div>
+            <p>Did the werewolves read the <span class="small">small print</span>?</p>
+            </div>
+            <div>
+            <p>Where did all the <span class="underline small">cores</span> run off to?</p>
+            </div>
+            <div>
+            <p>We need <span class="line-through">ten</span> make that twenty VMs.</p>
+            </div>
+            <div>
+            <p><span class="big">O</span>nce upon an infinite loop.</p>
+            </div>
+          HTML
+
+          expect(render(input, context)).to include(output.strip)
+        end
+      end
+
       context 'with fenced block' do
         it 'highlights syntax' do
           input = <<~ADOC