History

Add warning for BIDI characters in page renders and in diffs (#17562)

Fix #17514 Given the comments I've adjusted this somewhat. The numbers of characters detected are increased and include things like the use of U+300 to make à instead of à and non-breaking spaces. There is a button which can be used to escape the content to show it.

zeripath committed 4 years ago

Commit 21ed4fd1 parent ee60f2726 files · +809 −87Browse files

Showing the changes to services/gitdiff/gitdiff.go (1 of 26 files). Show all

Unified · Split

services/gitdiff/gitdiff.go+30−12
@@ -169,11 +169,11 @@ func getDiffLineSectionInfo(treePath, line string, lastLeftIdx, lastRightIdx int · 168 unmodified lines
169169 }
170170
171171 // escape a line's content or return <br> needed for copy/paste purposes
172−func getLineContent(content string) string {
172+func getLineContent(content string) DiffInline {
173173 if len(content) > 0 {
174− return html.EscapeString(content)
174+ return DiffInlineWithUnicodeEscape(template.HTML(html.EscapeString(content)))
175175 }
176− return "<br>"
176+ return DiffInline{Content: "<br>"}
177177 }
178178
179179 // DiffSection represents a section of a DiffFile.
@@ -411,7 +411,7 @@ func fixupBrokenSpans(diffs []diffmatchpatch.Diff) []diffmatchpatch.Diff { · 231 unmodified lines
411411 return fixedup
412412 }
413413
414−func diffToHTML(fileName string, diffs []diffmatchpatch.Diff, lineType DiffLineType) template.HTML {
414+func diffToHTML(fileName string, diffs []diffmatchpatch.Diff, lineType DiffLineType) DiffInline {
415415 buf := bytes.NewBuffer(nil)
416416 match := ""
417417
@@ -483,7 +483,7 @@ func diffToHTML(fileName string, diffs []diffmatchpatch.Diff, lineType DiffLineT · 65 unmodified lines
483483 buf.Write(codeTagSuffix)
484484 }
485485 }
486− return template.HTML(buf.Bytes())
486+ return DiffInlineWithUnicodeEscape(template.HTML(buf.String()))
487487 }
488488
489489 // GetLine gets a specific line by type (add or del) and file line number
@@ -535,10 +535,28 @@ func init() { · 45 unmodified lines
535535 diffMatchPatch.DiffEditCost = 100
536536 }
537537
538+// DiffInline is a struct that has a content and escape status
539+type DiffInline struct {
540+ EscapeStatus charset.EscapeStatus
541+ Content template.HTML
542+}
543+
544+// DiffInlineWithUnicodeEscape makes a DiffInline with hidden unicode characters escaped
545+func DiffInlineWithUnicodeEscape(s template.HTML) DiffInline {
546+ status, content := charset.EscapeControlString(string(s))
547+ return DiffInline{EscapeStatus: status, Content: template.HTML(content)}
548+}
549+
550+// DiffInlineWithHighlightCode makes a DiffInline with code highlight and hidden unicode characters escaped
551+func DiffInlineWithHighlightCode(fileName, language, code string) DiffInline {
552+ status, content := charset.EscapeControlString(highlight.Code(fileName, language, code))
553+ return DiffInline{EscapeStatus: status, Content: template.HTML(content)}
554+}
555+
538556 // GetComputedInlineDiffFor computes inline diff for the given line.
539−func (diffSection *DiffSection) GetComputedInlineDiffFor(diffLine *DiffLine) template.HTML {
557+func (diffSection *DiffSection) GetComputedInlineDiffFor(diffLine *DiffLine) DiffInline {
540558 if setting.Git.DisableDiffHighlight {
541− return template.HTML(getLineContent(diffLine.Content[1:]))
559+ return getLineContent(diffLine.Content[1:])
542560 }
543561
544562 var (
@@ -555,26 +573,26 @@ func (diffSection *DiffSection) GetComputedInlineDiffFor(diffLine *DiffLine) tem · 10 unmodified lines
555573 // try to find equivalent diff line. ignore, otherwise
556574 switch diffLine.Type {
557575 case DiffLineSection:
558− return template.HTML(getLineContent(diffLine.Content[1:]))
576+ return getLineContent(diffLine.Content[1:])
559577 case DiffLineAdd:
560578 compareDiffLine = diffSection.GetLine(DiffLineDel, diffLine.RightIdx)
561579 if compareDiffLine == nil {
562− return template.HTML(highlight.Code(diffSection.FileName, language, diffLine.Content[1:]))
580+ return DiffInlineWithHighlightCode(diffSection.FileName, language, diffLine.Content[1:])
563581 }
564582 diff1 = compareDiffLine.Content
565583 diff2 = diffLine.Content
566584 case DiffLineDel:
567585 compareDiffLine = diffSection.GetLine(DiffLineAdd, diffLine.LeftIdx)
568586 if compareDiffLine == nil {
569− return template.HTML(highlight.Code(diffSection.FileName, language, diffLine.Content[1:]))
587+ return DiffInlineWithHighlightCode(diffSection.FileName, language, diffLine.Content[1:])
570588 }
571589 diff1 = diffLine.Content
572590 diff2 = compareDiffLine.Content
573591 default:
574592 if strings.IndexByte(" +-", diffLine.Content[0]) > -1 {
575− return template.HTML(highlight.Code(diffSection.FileName, language, diffLine.Content[1:]))
593+ return DiffInlineWithHighlightCode(diffSection.FileName, language, diffLine.Content[1:])
576594 }
577− return template.HTML(highlight.Code(diffSection.FileName, language, diffLine.Content))
595+ return DiffInlineWithHighlightCode(diffSection.FileName, language, diffLine.Content)
578596 }
579597
580598 diffRecord := diffMatchPatch.DiffMain(highlight.Code(diffSection.FileName, language, diff1[1:]), highlight.Code(diffSection.FileName, language, diff2[1:]), true)