Delete gist embed rule to avoid XSS

increments · Mar 19, 2021 · b5d4e60 · b5d4e60
1 parent 3fa3613
commit b5d4e60
Show file tree

Hide file tree

Showing 4 changed files with 0 additions and 33 deletions.
diff --git a/lib/qiita/markdown.rb b/lib/qiita/markdown.rb
@@ -10,7 +10,6 @@
 require "qiita/markdown/embed/code_pen"
 require "qiita/markdown/embed/tweet"
 require "qiita/markdown/embed/asciinema"
-require "qiita/markdown/embed/gist"
 require "qiita/markdown/embed/youtube"
 require "qiita/markdown/embed/slide_share"
 require "qiita/markdown/embed/google_slide"

diff --git a/lib/qiita/markdown/embed/gist.rb b/lib/qiita/markdown/embed/gist.rb
diff --git a/lib/qiita/markdown/transformers/filter_script.rb b/lib/qiita/markdown/transformers/filter_script.rb
@@ -10,7 +10,6 @@ class FilterScript
 
         HOST_WHITE_LIST = [
           Embed::Asciinema::SCRIPT_HOST,
-          Embed::Gist::SCRIPT_HOST,
         ].flatten.freeze
 
         def self.call(*args)

diff --git a/spec/qiita/markdown/processor_spec.rb b/spec/qiita/markdown/processor_spec.rb
@@ -1451,28 +1451,6 @@
         end
       end
 
-      context "with HTML embed code for Gist" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <script id="example" src="https://gist.github.com/a/example.js"></script>
-          MARKDOWN
-        end
-
-        if allowed
-          it "does not sanitize embed code" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js"></script>
-            HTML
-          end
-        else
-          it "forces async attribute on script" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js" async="async"></script>
-            HTML
-          end
-        end
-      end
-
       context "with HTML embed code for Youtube" do
         let(:markdown) do
           <<-MARKDOWN.strip_heredoc