Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown
该报告还没有中文解读。
原文摘录
摘自原文（8771 字符中的一小部分）
`ActionText::Content#to_markdown` escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is `<code>` or `<pre>` is exempt from that escaping (`MarkdownConversion::SKIP_ESCAPING_PARENTS`) and is instead kept inert by the delimiter its visitor …
原文中的代码
line. `visit__heading` (`:197-199`) splices that block output into a line it has already begun, so the fence opens nothing and the content it was meant to fence is live. `visit_summary` (`:247-249`), `visit_tr` (`:237-245`) and `visit__table_header_row` (`:282-287`) do the same thing; …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Ruby on Rails 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @thepo1es · 版权归作者与 Ruby on Rails 所有