GitLab strips <tags>

Problem

GitLab strips <tags>

Example:

On the GitLab server, navigate to the project's repository directory. For an installation from source the path is usually /home/git/repositories//.git. For Omnibus installs the path is usually /var/opt/gitlab/git-data/repositories//.git.

What I pasted:

On the GitLab server, navigate to the project's repository directory. For an installation from source the path is usually /home/git/repositories/<group>/<project>.git. For Omnibus installs the path is usually /var/opt/gitlab/git-data/repositories/<group>/<project>.git.

Expected behavior:

GitLab should have repalce < with < and > with >

Reassigned to @dzaporozhets

This happens not only in the tickets, but in commit messages, etc.

Unless I'm mistaken about something, this is fairly difficult to allow.

1. HTML::Pipeline's SanitizationFilter strips all non-valid HTML tags from the input, such as these.
2. We could escape_once the user-entered text before it gets passed to Pipeline, but then the inline html section of the GFM guide becomes invalid, as it would escape all tags.

I wrote a custom SanitizationFilter transformer that allows for the invalid tags, but the problem then is removing the closing tags that Nokogiri automatically inserts.

Ok, so I got this "working", but it's way more involved than you would think, and I kind of don't even want to submit a MR for it.

The failing spec: https://gitlab.com/tsigo-gitlab/gitlab-ce/commit/a692c46e11eca403414238c8cc8f9357bcb06686

The fix: https://gitlab.com/tsigo-gitlab/gitlab-ce/commit/32ec9b77ab6fe6207d3b9c8a2f5e5602fbad671a

Now, I could remove the huge real_tags declaration, but then instead of sanitizing valid, unwanted tags (like <textarea> or <blink>), they'd be printed, escaped, without the closing tags just like fake tags <project> and <group>.

Alternatively: Just tell people to use [project] instead of <project>

Related: issue #1015 (closed) and issue #800 (closed)

@razer6 Please reassign this issue, and the two mentioned above, to me.

@rspeicher I can only assign to project/group members.

Reassigned to @rspeicher

@rspeicher Has this been fixed with the last version

Testing:

On the GitLab server, navigate to the project's repository directory. For an installation from source the path is usually /home/git/repositories//.git. For Omnibus installs the path is usually /var/opt/gitlab/git-data/repositories//.git.

Nope, not fixed.

@rspeicher what is the status of this?

Milestone removed

Assignee removed

@sytses Not fixed. Unfortunately there's not a good way that I can think of to do it. See previous note.

mentioned in issue #19534 (moved)

Closing in favor of #19534 (moved)

Status changed to closed

mentioned in merge request !14785