Blogdown 0.2.3 → 0.2.4

raw patch · 7 files changed

+37/−17 lines, 7 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• Blogdown.cabal +3/−1
• ChangeLog.md +8/−0
• Readme.md +5/−2
• src/Parsing/ParseBlock.hs +4/−4
• src/Parsing/State.hs +2/−2
• src/Parsing/Text.hs +7/−8
• test/Test.hs +8/−0

@@ -1,5 +1,5 @@ name:                Blogdown-version:             0.2.3+version:             0.2.4 synopsis:            A markdown-like markup language designed for blog posts description:         A library and executable that implement a modified, extended version of Markdown designed for writing blog posts. license:             AGPL-3@@ -24,6 +24,7 @@  executable Blogdown   main-is:             Blogdown.hs+  other-modules:       AST, Options, Parsing.Parse, Parsing.ParseOptions, Parsing.ParseBlock, Parsing.ParseInline, Parsing.Text, Parsing.Utils, Parsing.ParseFootnotes, Parsing.ParseHtml, Parsing.State, Parsing.TextUtils, Rendering.Render, Rendering.RenderOptions, Footnotes_css, Footnotes_js   other-extensions:    DeriveGeneric   build-depends:       base >=4.9 && <5, parsec >=3.1 && <3.2, containers >=0.5 && <0.6, MissingH >=1.4 && <1.5, network-uri >=2.6 && <2.7   hs-source-dirs:      src, assets@@ -32,6 +33,7 @@ test-suite Test   type:                exitcode-stdio-1.0   main-is:             Test.hs+  other-modules:       AST, Options, Parsing.Parse, Parsing.ParseOptions, Parsing.ParseBlock, Parsing.ParseInline, Parsing.Text, Parsing.Utils, Parsing.ParseFootnotes, Parsing.ParseHtml, Parsing.State, Parsing.TextUtils, Rendering.Render, Rendering.RenderOptions, Footnotes_css, Footnotes_js   other-extensions:    DeriveGeneric   build-depends:       base >=4.9 && <5, parsec >=3.1 && <3.2, containers >=0.5 && <0.6, MissingH >=1.4 && <1.5, network-uri >=2.6 && <2.7   hs-source-dirs:      src, assets, test

@@ -1,5 +1,13 @@ # Revision history for Blogdown +### 0.2.4 -- 2018-02-04++* Fix parsing blank lines in blockquotes.++### 0.2.3 -- 2017-10-24++* Fix potential XSS vulnerability.+ ### 0.2.2 -- 2017-05-21  * Add missing other-modules.

@@ -17,7 +17,7 @@ While there have been attemps to create a common Markdown standard--most notably [CommonMark](http://commonmark.org/)--they are necessarily quite complex. The primary cause of this complexity is that Markdown insists on rendering *something* for every input, no matter how malformed. Blogdown is considerably simpler, and hopefully easier for authors to debug, because it fails on malformed inputs.-With full compatability out of the window, I have chosen to make some other small improvements on Markdown syntax.+With full compatibility out of the window, I have chosen to make some other small improvements on Markdown syntax.  ## Installation @@ -41,6 +41,8 @@      cat blogpost.md | ./Blogdown > blogpost.html +If using `Blogdown` to process untrusted input for display in a web page, you **must** use the `--allowed-tags` and `--allowed-attributes` flags.+ ### Optional Styling and Scripts  It is recommended to include `footnotes.css` and `footnotes.js` on any pages which make use of Blogdown-generated footnotes,@@ -58,7 +60,7 @@ they are rendered. If no list is supplied, all attributes are stripped.  * `--allow-unsafe-tags`: By default, Blogdown will fail when it encounters a `<script>` or a `<style>` tag, because there are certain corner cases it cannot parse correctly,-e.g. `<style>"</style>"evil()"<style>"</style>`. However, these are unlikely on+e.g. `<script>"</script>"evil()"<script>"</script>`. However, these are unlikely on non-malicious input, so this flag can be passed to attempt parsing these tags.  * `--em-dashes`: If this flag is passed, `--` will be replaced with "&mdash;" in text.  * `--footnote-backlinks`: If this flag is passed, footnotes will be preceded by a caret linking back to the point where the footnote is referenced.@@ -155,6 +157,7 @@  * **Code Block**: Lines indented with 4+ spaces or a tab define a code block. Code blocks are rendered verbatim, ignoring special characters. Note that the first un-indented line will start a new block.+ * **Code Block (GitHub style)**: A line consisting of `\`\`\`` followed by an optional class name will also start a code block, which is ended by a line consisting of `\`\`\``. The class name will be added to the `code` tag (unless disallowed by `--allowed-attributes`) and is intended to support code highlighting libraries.  * **HTML Block**: An HTML tag at the beginning of a line starts an HTML block. Its contents must be valid HTML, and it is ended by the corresponding closing tag. HTML blocks are rendered verbatim, unless HTML bleaching is enabled.

@@ -48,13 +48,13 @@ listBlock :: Parser Block listBlock = fmap ListBlock (list True 1 <|> list False 1) -blockQuoteLineStart :: Parser String-blockQuoteLineStart = try (string "> ") <?> "\"> \" (blockquote)"+blockQuotePrefix :: Parser String+blockQuotePrefix = try (string' "> ") <?> "\"> \" (blockquote)"  blockQuote :: Parser Block blockQuote = fmap BlockQuote $ do-    blockQuoteLineStart-    withModifiedState (many1 inline) $ \s -> s {prevCharIsNewline=False, skipPrefix=(blockQuoteLineStart >> many (char ' '))}+    blockQuotePrefix+    withModifiedState (many1 inline) $ \s -> s {skipPrefix=Just blockQuotePrefix}  blockCodeLineStart :: Parser String blockCodeLineStart = try (string "\t" <|> string "    ") <?> "\"    \" or tab (code block)"

@@ -7,7 +7,7 @@  data ParserState = ParserState {     prevCharIsNewline :: Bool,-    skipPrefix :: Parser String,+    skipPrefix :: Maybe (Parser String),     inlineParserStack :: [String],     footnoteIndices :: M.Map String Int,     options :: ParseOptions@@ -16,7 +16,7 @@  initialState = ParserState{     prevCharIsNewline=False,-    skipPrefix=string "",+    skipPrefix=Nothing,     inlineParserStack=[],     footnoteIndices=M.fromList [],     options=defaultParseOptions

@@ -1,5 +1,6 @@ module Parsing.Text (plaintext) where +import Data.List.Utils (endswith) import Data.Maybe import Text.Parsec @@ -32,13 +33,11 @@ nonSpecials = do     state <- getState     str <- if prevCharIsNewline state-        then do-            s <- skipPrefix state-            if null s-                then do-                    c <- nonSpecial firstCharSpecials-                    return [c]-                else return s+        then if isJust (skipPrefix state)+            then (fromJust $ skipPrefix state) >> return ""+            else do+                c <- nonSpecial firstCharSpecials+                return [c]         else do             s <- many $ nonSpecial ('\n' : specials)             c <- suppressErr (optionMaybe $ char '\n')@@ -47,7 +46,7 @@                 else if null s                     then fail ""    -- Don't succeed without consuming any input.                     else return s-    putState $ state {prevCharIsNewline=(last str == '\n')}+    putState $ state {prevCharIsNewline=(endswith "\n" str)}     return str  -- Parse as many non-special characters as possible.

@@ -125,6 +125,13 @@     "<blockquote>    \"This is it... this is where I belong...\"\n\     \    I know everyone here... even if I've never met them, never talked to\n\     \them, may never hear from them again... I know you all...</blockquote>"+testBlockQuoteBlankLines = expectSuccess "blockquote with blank lines" blockQuote+    "> a. A\n\+    \> \n\+    \> b. B"+    "<blockquote>a. A\n\+    \\n\+    \b. B</blockquote>" testBlockCodeIndented = expectSuccess "block code (indented)" blockCodeIndented     "    var x = 0;\n\     \    alert(x);\n"@@ -399,6 +406,7 @@         testNestedList,         testBlockQuote,         testBlockQuotePreFormatted,+        testBlockQuoteBlankLines,         testBlockCodeIndented,         testBlockCodeWhitespace,         testBlockCodeSpecialChars,