Re: ruby-sqlite3 2.10.0

[Simon Quigley]

Hi Soren,

On 10/23/26 13:10, Soren Stoutner wrote:

On Monday, October 19, 2026 8:43:51 PM Mountain Standard Time Soren Stoutner
wrote:

I will do some testing in the next few days against ruby-sqlite3 2.10.0.  If
everything looks good I will upload it and a new redmine release to

unstable.

If anyone anticipates ruby-sqlite3 2.10.0 might break any other packages and
would like me to hold off on uploading it to unstable, please let me know.

The recent ruby-commonmarker 2.10.1-1 upload broke redmine (and a number of
other dependendies).

https://tracker.debian.org/pkg/ruby-commonmarker

I receive the following error when building redmine:

   1) Failure:
Redmine::WikiFormatting::CommonMark::FormatterTest#test_should_escape_unwanted_tags
[test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb:277]:
--- expected
+++ actual
@@ -1 +1 @@
-"<p>sit<br>amet &lt;style&gt;.foo { color: #fff; }&lt;/style&gt;
&lt;script&gt;alert(\"hello world\");&lt;/script&gt;</p>"
+"<p>sit<br>amet .foo { color: #fff; } </p>"

We probably need to clean this up before I can test ruby-sqlite3 2.10.0.

Commonmarker 2.10.1 dropped the tagfilter extension. Comrak deprecated it in 
0.55 and removed it in 0.56, so the 2.10.1 binding ignores tagfilter: true, 
which Redmine still sets in 
Redmine::WikiFormatting::CommonMark::MarkdownFilter. Style and script therefore 
come out as real HTML, and Sanitize strips the script element and everything 
inside it, and strips the style tags while leaving the CSS text behind. That's 
the failure in FormatterTest#test_should_escape_unwanted_tags.

The patch below puts the GitHub Flavored Markdown tagfilter back in Redmine, on the HTML 
Commonmarker returns, before SanitizationFilter runs. It escapes the leading 
"<" of title, textarea, style, xmp, iframe, noembed, noframes, script, and 
plaintext, closing tags included, which is what comrak 0.54 did for commonmarker 2.10.0. I 
ran this test's input through commonmarker 2.10.1 and ruby-sanitize 7.0.0 with the filter 
applied, and the result matches the expected string.

I hope this helps.

--- a/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
@@ -26,18 +26,33 @@
       # does not allow for straightforward configuration of render and parsing
       # options
       class MarkdownFilter < HTML::Pipeline::TextFilter
+        # Commonmarker 2.10 dropped the tagfilter extension. Escape the
+        # leading "<" of the GFM disallowed tags before sanitization.
+        DISALLOWED_TAGS = %r{
+          <
+          (?=
+            /?
+            
(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)
+            (?:[ \t\r\n\f\v]|>|/>)
+          )
+        }ix
+
         def initialize(text, context = nil, result = nil)
           super
           @text = @text.delete "\r"
         end

         def call
+          extension_options = extensions.dup
+          tagfilter = extension_options.delete(:tagfilter)
+
           html = Commonmarker.to_html(@text, options: {
-                                        extension: extensions,
+                                        extension: extension_options,
             render: render_options,
             parse: parse_options
                                       }, plugins: plugins)

+          html = filter_disallowed_tags(html) if tagfilter
           html.rstrip!
           html
         end
@@ -59,6 +74,10 @@
         def plugins
           context.fetch :commonmarker_plugins, {}
         end
+
+        def filter_disallowed_tags(html)
+          html.gsub(DISALLOWED_TAGS, '&lt;')
+        end
       end
     end
   end

Best regards,
Simon Quigley
tsimo...@debian.org

OpenPGP_signature.asc
Description: OpenPGP digital signature