diff options
| author | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2022-03-28 18:36:56 +0900 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2022-10-07 12:09:20 +0900 |
| commit | deaa65660822e070294d6c2a7dfec286cbbdff56 (patch) | |
| tree | a3b282f3a4dde05872caa7e10a5717238fdf9790 /lib/rdoc | |
| parent | 0472effc41918f85c17e11885595ff810955e626 (diff) | |
[ruby/rdoc] Escape TIDYLINKs
https://hackerone.com/reports/1187156
https://github.com/ruby/rdoc/commit/1ad2dd3ca2
Diffstat (limited to 'lib/rdoc')
| -rw-r--r-- | lib/rdoc/markup/to_html.rb | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/rdoc/markup/to_html.rb b/lib/rdoc/markup/to_html.rb index 61f14d3ab7..3c4f82f748 100644 --- a/lib/rdoc/markup/to_html.rb +++ b/lib/rdoc/markup/to_html.rb @@ -154,9 +154,13 @@ class RDoc::Markup::ToHtml < RDoc::Markup::Formatter text =~ /^\{(.*)\}\[(.*?)\]$/ or text =~ /^(\S+)\[(.*?)\]$/ label = $1 - url = $2 + url = CGI.escapeHTML($2) - label = handle_RDOCLINK label if /^rdoc-image:/ =~ label + if /^rdoc-image:/ =~ label + label = handle_RDOCLINK(label) + else + label = CGI.escapeHTML(label) + end gen_url url, label end |