On Friday, October 23, 2026 12:37:42 PM Mountain Standard Time Simon Quigley wrote: > Hi Soren, > > On 10/23/26 13:10, Soren Stoutner wrote: > > > On Monday, October 19, 2026 8:43:51 PM Mountain Standard Time Soren > > Stoutner > > wrote: > > > >> I will do some testing in the next few days against ruby-sqlite3 2.10.0. > >> If > >> everything looks good I will upload it and a new redmine release to > > > > unstable. > > > >> If anyone anticipates ruby-sqlite3 2.10.0 might break any other packages > >> and > >> would like me to hold off on uploading it to unstable, please let me know. > > > > > > The recent ruby-commonmarker 2.10.1-1 upload broke redmine (and a number of > > other dependendies). > > > > https://tracker.debian.org/pkg/ruby-commonmarker > > > > I receive the following error when building redmine: > > > > > > 1) Failure: > > > > Redmine::WikiFormatting::CommonMark::FormatterTest#test_should_escape_unwant > > ed_tags > > [test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb:277]: > > --- expected > > +++ actual > > @@ -1 +1 @@ > > -"<p>sit<br>amet <style>.foo { color: #fff; }</style> > > <script>alert(\"hello world\");</script></p>" > > +"<p>sit<br>amet .foo { color: #fff; } </p>" > > > > We probably need to clean this up before I can test ruby-sqlite3 2.10.0. > > > Commonmarker 2.10.1 dropped the tagfilter extension. Comrak deprecated it in > 0.55 and removed it in 0.56, so the 2.10.1 binding ignores tagfilter: true, > which Redmine still sets in > Redmine::WikiFormatting::CommonMark::MarkdownFilter. Style and script > therefore come out as real HTML, and Sanitize strips the script element and > everything inside it, and strips the style tags while leaving the CSS text > behind. That's the failure in > FormatterTest#test_should_escape_unwanted_tags.
> The patch below puts the GitHub Flavored Markdown tagfilter back in Redmine,
> on the HTML Commonmarker returns, before SanitizationFilter runs. It escapes
> the leading "<" of title, textarea, style, xmp, iframe, noembed, noframes,
> script, and plaintext, closing tags included, which is what comrak 0.54 did
> for commonmarker 2.10.0. I ran this test's input through commonmarker 2.10.1
> and ruby-sanitize 7.0.0 with the filter applied, and the result matches the
> expected string.
> I hope this helps.
>
> --- a/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
> +++ b/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
> @@ -26,18 +26,33 @@
> # does not allow for straightforward configuration of render and
> parsing
# options
> class MarkdownFilter < HTML::Pipeline::TextFilter
> + # Commonmarker 2.10 dropped the tagfilter extension. Escape the
> + # leading "<" of the GFM disallowed tags before sanitization.
> + DISALLOWED_TAGS = %r{
> + <
> + (?=
> + /?
> +
> (?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)
+
> (?:[ \t\r\n\f\v]|>|/>)
> + )
> + }ix
> +
> def initialize(text, context = nil, result = nil)
> super
> @text = @text.delete "\r"
> end
>
> def call
> + extension_options = extensions.dup
> + tagfilter = extension_options.delete(:tagfilter)
> +
> html = Commonmarker.to_html(@text, options: {
> - extension: extensions,
> + extension: extension_options,
> render: render_options,
> parse: parse_options
> }, plugins: plugins)
>
> + html = filter_disallowed_tags(html) if tagfilter
> html.rstrip!
> html
> end
> @@ -59,6 +74,10 @@
> def plugins
> context.fetch :commonmarker_plugins, {}
> end
> +
> + def filter_disallowed_tags(html)
> + html.gsub(DISALLOWED_TAGS, '<')
> + end
> end
> end
> end
It seems crazy to me that ruby-commonmarker would drop tagfilter without even
mentioning it in the changelog. I get that it was because support was dropped
by comrack, so they had to do it. But you think they would at least mention
this as a breaking change (and probably bump the version by a bigger number).
I am impressed that you were able to put together the above patch so quickly.
I was able to find an upstream redmine bug report regarding this issue.
https://www.redmine.org/issues/44634
It contains a patch that has been applied to their trunk. It basically does
the same thing your patch does, as well as add an additional test. I have
applied it and uploaded redmine redmine_6.1.5+ds-3.
--
Soren Stoutner
[email protected]
signature.asc
Description: This is a digitally signed message part.
