{"action":"created","issue":{"url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/8007","labels_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/8007/labels{/name}","comments_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/8007/comments","events_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/8007/events","html_url":"https://github.com/gitlabhq/gitlabhq/pull/8007","id":45516828,"number":8007,"title":"Allow HTML tags in user Markdown input","user":{"login":"mr-vinn","id":2551678,"avatar_url":"https://avatars.githubusercontent.com/u/2551678?v=3","gravatar_id":"","url":"https://api.github.com/users/mr-vinn","html_url":"https://github.com/mr-vinn","followers_url":"https://api.github.com/users/mr-vinn/followers","following_url":"https://api.github.com/users/mr-vinn/following{/other_user}","gists_url":"https://api.github.com/users/mr-vinn/gists{/gist_id}","starred_url":"https://api.github.com/users/mr-vinn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mr-vinn/subscriptions","organizations_url":"https://api.github.com/users/mr-vinn/orgs","repos_url":"https://api.github.com/users/mr-vinn/repos","events_url":"https://api.github.com/users/mr-vinn/events{/privacy}","received_events_url":"https://api.github.com/users/mr-vinn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2014-10-10T19:45:04Z","updated_at":"2015-01-17T17:22:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/8007","html_url":"https://github.com/gitlabhq/gitlabhq/pull/8007","diff_url":"https://github.com/gitlabhq/gitlabhq/pull/8007.diff","patch_url":"https://github.com/gitlabhq/gitlabhq/pull/8007.patch"},"body":"This change fixes #7066, and issues [#147](https://gitlab.com/gitlab-org/gitlab-ce/issues/147), [#408](https://gitlab.com/gitlab-org/gitlab-ce/issues/408) and [#476](https://gitlab.com/gitlab-org/gitlab-ce/issues/476) from gitlab.com.\r\n\r\nThe Markdown parser currently uses Redcarpet's `:filter_html` option, which removes all HTML tags from user input.  The parser also calls ActionView's `#sanitize` method, which removes HTML tags and attributes that are not whitelisted.\r\n\r\nGitLab's [Markdown documentation](https://github.com/gitlabhq/gitlabhq/blob/master/doc/markdown/markdown.md#inline-html) says that inline HTML should be allowed, which seems incompatible with the `:filter_html` option.  This change disables that option to allow safe tags from user input to appear in the rendered HTML.\r\n\r\nHowever, relying on `#sanitize` at the end of parsing doesn't handle javascript in tag attributes correctly.  For example, this input:\r\n\r\n```html\r\n<a href=\"javascript:alert('foo')\">link text</a>\r\n```\r\n\r\nis rendered as:\r\n\r\n```html\r\n<a href=\"/namespace101/gitlabhq/blob/markdown/javascript:alert(&#39;foo&#39;)\">link text</a>\r\n```\r\n\r\nTo handle javascript in attributes, I added a call to `#sanitize` before parsing relative links.  This results in the correctly sanitized output:\r\n\r\n```html\r\n<a>link text</a>\r\n```"},"comment":{"url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/comments/70375159","html_url":"https://github.com/gitlabhq/gitlabhq/pull/8007#issuecomment-70375159","issue_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/8007","id":70375159,"user":{"login":"dblessing","id":2394772,"avatar_url":"https://avatars.githubusercontent.com/u/2394772?v=3","gravatar_id":"","url":"https://api.github.com/users/dblessing","html_url":"https://github.com/dblessing","followers_url":"https://api.github.com/users/dblessing/followers","following_url":"https://api.github.com/users/dblessing/following{/other_user}","gists_url":"https://api.github.com/users/dblessing/gists{/gist_id}","starred_url":"https://api.github.com/users/dblessing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dblessing/subscriptions","organizations_url":"https://api.github.com/users/dblessing/orgs","repos_url":"https://api.github.com/users/dblessing/repos","events_url":"https://api.github.com/users/dblessing/events{/privacy}","received_events_url":"https://api.github.com/users/dblessing/received_events","type":"User","site_admin":false},"created_at":"2015-01-17T17:22:05Z","updated_at":"2015-01-17T17:22:05Z","body":"ping @randx \r\n\r\nAlso, @namnatulco would you be interested in providing documentation in the meantime?"}}