gitlabhq/gitlabhq — pull request #8007 by mr-vinn (2014-10-10 19:45:04+00:00)
Title: Allow HTML tags in user Markdown input

This change fixes #7066, and issues [#147](https://gitlab.com/gitlab-org/gitlab-ce/issues/147) and [#476](https://gitlab.com/gitlab-org/gitlab-ce/issues/476) from gitlab.com.

The Markdown parser currently uses Redcarpet's `:filter_html` option, which removes all HTML tags from user input. The parser also calls ActionView's `#sanitize` method, which removes HTML tags and attributes that are not whitelisted.

GitLab's [Markdown documentation](doc/markdown/markdown.md#inline-html) says that inline HTML should be allowed, which seems incompatible with the `:filter_html` option. This change disables that option to allow safe tags from user input to appear in the rendered HTML.

However, relying on `#sanitize` at the end of parsing doesn't handle javascript in tag attributes correctly. For example, this input:

```html
link text
```

is rendered as:

```html
link text
```

To handle javascript in attributes, I added a call to `#sanitize` before parsing relative links. This results in the correctly sanitized output:

```html
link text
```