Redmine - Defect #35441
Inline image in Textile is not displayed if the image URL contains ampersands
2021-06-23 07:19 - Brice Beaumesnil

ステータス:

Closed

開始日:

優先度:

Normal

期日:担当者:

Go MAEDA

進捗率:0%

カテゴリ:

Text formatting

予定工数:0.00時間対象バージョン:4.2.2

Resolution:

Fixed

Affected version:

4.2.1

説明
Hello,In my projects, i include Sonar Badges (images without extension) in project's description with!!
(textile)
But since redmine 4.2 this include don't work anymore.
I test on new fresh redmine installation too (REDMINE 4.2.1 on ruby 2.7.3) : the same result, no image.
If i tried with markdown format : i have the image.
A Sonar Badget have this format :https://sonarqube.dev.mydomain/api/project̲badges/measure?project=fr.mydomain.myproject%3Amyproject&metric=alert̲status: no file extension (i think it's the problem because if i try an image with an extension, the image is include on the page)
This include works fine in redmine 4.1 and before
thanks
関連するチケット:
関連している Redmine - Feature #31500: Ruby 2.7 support

Closed関連している Redmine - Defect #29681: "x%x%" is rendered as "&"...

New

関係しているリビジョン
リビジョン 21101 - 2021-07-28 10:25 - Go MAEDA
Inline image in Textile is not displayed if the image URL contains ampersands (#35441).
Contributed by Yuichi HARADA.
リビジョン 21108 - 2021-07-29 01:36 - Go MAEDA
Merged r21101 from trunk to 4.2-stable (#35441).

履歴#1 - 2021-06-24 15:14 - Brice Beaumesnil
I tried to see the result here :4a042b8382a008d344561c8301509f3a?s=32&amp;d=identicon&amp;r=PG
On redmine 4.2.1, the image don't appear, I see all the textile code in place.
!https://www.gravatar.com/avatar/4a042b8382a008d344561c8301509f3a?s=32&d=identicon&r=PG!
#2 - 2021-06-24 17:51 - Brice Beaumesnil- ファイル redmine4.2.1-Ruby2.7.3.png を追加
Test on new installation of REDMINE 4.2.1 on Windows with Ruby 2.7.3

2024-10-01

1/3

#3 - 2021-06-25 05:09 - Go MAEDA- ステータス を New から Confirmed に変更
Thank you for reporting the issue. I have confirmed the issue on the latest trunk.
But the latest 4.2-stable branch (including released 4.2.1) is not affected. Maybe you are using the trunk or the master branch of GitHub, aren't you?
Their version number is also "4.2.1" but has ".devel" suffix (e.g. "4.2.1.devel").
#4 - 2021-06-25 10:53 - Brice Beaumesnil
I used github 4.2-stable branch for my install
Environment:
Redmine version
4.2.1.stable
Ruby version
2.7.3-p183 (2021-04-05) [x64-mingw32]
Rails version
5.2.6
Environment
production
Database adapter
PostgreSQL
Mailer queue
ActiveJob::QueueAdapters::AsyncAdapter
Mailer delivery
smtp
SCM:
Subversion
1.8.16Git
2.29.2
FilesystemRedmine plugins:no plugin installed#5 - 2021-07-02 04:57 - Yuichi HARADA- ファイル 35441.patch を追加
In the case of Textile, RedCloth3#inline̲textile̲image(source:/trunk/lib/redmine/wiki̲formatting/textile/redcloth3.rb#L950) is executed togenerate the image tag, but the image could not be displayed because False is returned in Redmine::Helpers::URL#uri̲with̲safe̲scheme?(
source:/trunk/lib/redmine/helpers/url.rb#L25).
In uri̲with̲safe̲scheme?, the string converted of the input URI (including query string) by RedCloth3#incomming̲entries(source:/trunk/lib/redmine/wiki̲formatting/textile/redcloth3.rb#L1001) is passed as a parameter. However, an error occurred because thisconversion string could not be parsed by URI.parse of source:/trunk/lib/redmine/helpers/url.rb#L31 .
The following patch removes the query string from the conversion string.
diff --git a/lib/redmine/helpers/url.rb b/lib/redmine/helpers/url.rb
index 0c6cbdecd7..40801ee7c8 100644--- a/lib/redmine/helpers/url.rb+++ b/lib/redmine/helpers/url.rb@@ -28,7 +28,7 @@module Redmine
return true unless uri.to̲s.include? ":"# Other URLs need to be parsed
schemes.include? URI.parse(uri).scheme
schemes.include? URI.parse(uri.split('?').first).scheme
rescue URI::Error
false
end+

#6 - 2021-07-24 01:30 - Go MAEDA
I found that the issue is reproducible when the version of Ruby is 2.7 or higher. This is because URI.parse in Ruby 2.7 or later raises
URI::InvalidURIError if the query string in a given URI is invalid.
As explained in #35441#note-5, the Textile formatter temporarily replaces "&" in URIs with two "x%" (source:tags/4.2.1/lib/redmine/wiki̲formatting/textile/redcloth3.rb#L1001). The conversion makes a URI with a query string malformed. The
malformed URI causes URI::InvalidURIError while checking if the URI scheme is safe at source:tags/4.2.1/lib/redmine/helpers/url.rb#L31.
It has never caused the reported problem before because URI.parse in Ruby 2.6 or earlier allows URIs with such a malformed query string.
#7 - 2021-07-24 09:17 - Go MAEDA- ファイル 35441-v2.patch を追加- 題名 を include image without extension failed in redmine 4.2 から Inline image in Textile is not displayed if the image URL contains ampersandsに変更- 対象バージョン を Candidate for next minor release にセット
Update the patch.

2024-10-01

2/3

Add a test that describes the issue to ApplicationHelperTest#test̲inline̲images
Remove a query string in RedCloth3#inline̲textile̲image instead of Redmine::Helpers::URL.uri̲with̲safe̲scheme?. This is because the causeof the issue is the temporary data conversion of RedCloth3#inline̲textile̲image and Markdown formatter is not affected by the issue at all
Replaced String#split with faster String#partition#8 - 2021-07-27 11:27 - Go MAEDA- 対象バージョン を Candidate for next minor release から 4.2.2 に変更
Setting the target version to 4.2.2.
#9 - 2021-07-27 11:31 - Go MAEDA- 関連している Feature #31500: Ruby 2.7 support を追加#10 - 2021-07-27 12:51 - Mischa The Evil
I did some research on the background of this change in Ruby to see what changed exactly and why, and if it was an intentional change or aregression bug.
To summarize:
It was an intentional change introduced in Ruby 2.7.x.
Upstream Ruby issue
Upstream GitHub commit
It was a change to fix a regression introduced in Ruby 2.2.x (so this would not have been an issue when Redmine was running on Ruby <=2.1.x)
Upstream GitHub commit#11 - 2021-07-28 10:27 - Go MAEDA- ステータス を Confirmed から Resolved に変更- 担当者 を Go MAEDA にセット
- Resolution を Fixed にセット
Committed the patch. Thank you for your contribution.
Mischa The Evil wrote:
I did some research on the background of this change in Ruby to see what changed exactly and why, and if it was an intentional change or aregression bug.
To summarize:
It was an intentional change introduced in Ruby 2.7.x.
Upstream Ruby issue
Upstream GitHub commit
It was a change to fix a regression introduced in Ruby 2.2.x (so this would not have been an issue when Redmine was running on Ruby<= 2.1.x)
Upstream GitHub commit

Thank you for your detailed investigation.
#12 - 2021-07-29 01:37 - Go MAEDA- ステータス を Resolved から Closed に変更#13 - 2021-08-04 17:37 - Mischa The Evil
- 関連している Defect #29681: "x%x%" is rendered as "&" in Textile formatter を追加

ファイル
redmine4.2.1-Ruby2.7.3.png

22.9 KB

2021-06-24

Brice Beaumesnil

35441.patch

1.28 KB

2021-07-02

Yuichi HARADA

35441-v2.patch

1.43 KB

2021-07-24

Go MAEDA

2024-10-01

3/3