(allura) 01/02: remove class and id attributes when parsing markdown to html

[di...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

dill0wn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 06ca954f1c2049895accad64412a32e2b8a4e13b
Author: Guillermo Cruz <gu...@slashdotmedia.com>
AuthorDate: Wed Aug 13 13:27:34 2025 -0600

    remove class and id attributes when parsing markdown to html
---
 Allura/allura/lib/utils.py                         |  3 ++-
 .../forgeimporters/github/tests/test_wiki.py       | 29 ++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/Allura/allura/lib/utils.py b/Allura/allura/lib/utils.py
index 0391f026c..26126bf83 100644
--- a/Allura/allura/lib/utils.py
+++ b/Allura/allura/lib/utils.py
@@ -555,7 +555,8 @@ def __init__(self, *args, **kwargs):
 
         # srcset is used in our own project_list/project_summary widgets
         # which are used as macros so go through markdown
-        self.allowed_attributes = html5lib.filters.sanitizer.allowed_attributes | {(None, 'srcset')}
+        excluded_attributes = {(None, 'class'), (None, 'id')}
+        self.allowed_attributes = (html5lib.filters.sanitizer.allowed_attributes | {(None, 'srcset')}) - excluded_attributes
 
         self.valid_iframe_srcs = ('https://www.youtube.com/embed/',
                                   'https://www.youtube-nocookie.com/embed/',
diff --git a/ForgeImporters/forgeimporters/github/tests/test_wiki.py b/ForgeImporters/forgeimporters/github/tests/test_wiki.py
index d3b53dbda..e85eb5f7a 100644
--- a/ForgeImporters/forgeimporters/github/tests/test_wiki.py
+++ b/ForgeImporters/forgeimporters/github/tests/test_wiki.py
@@ -28,13 +28,42 @@
 from forgeimporters.github.wiki import GitHubWikiImporter
 from forgeimporters.github.utils import GitHubMarkdownConverter
 from forgeimporters.github import GitHubOAuthMixin
+from forgewiki import model as WM
+from alluratest.controller import setup_basic_test, setup_unit_test
+from allura.tests import decorators as td
+from allura.lib import helpers as h
+from tg import tmpl_context as c, app_globals as g
 
+from Allura.allura.tests.model.test_artifact import Checkmessage
 
 # important to be distinct from 'test' which ForgeWiki uses, so that the
 # tests can run in parallel and not clobber each other
 test_project_with_wiki = 'test2'
 with_wiki = with_tool(test_project_with_wiki, 'wiki', 'w', 'wiki')
 
+class TestWikiPage:
+
+    def setup_method(self):
+        setup_basic_test()
+        setup_unit_test()
+        self.setup_with_tools()
+
+    @td.with_wiki
+    def setup_with_tools(self):
+        h.set_context('test', 'wiki', neighborhood='Projects')
+        Checkmessage.query.remove({})
+        WM.Page.query.remove({})
+        WM.PageHistory.query.remove({})
+        M.Shortlink.query.remove({})
+        c.user = M.User.query.get(username='test-admin')
+        Checkmessage.project = c.project
+        Checkmessage.app_config = c.app.config
+
+    def test_markdown_excluded_attributes(self):
+        pg = WM.Page(title='TestPage1')
+        pg.text = """# Test message <p class="markdown-class" id="markdown-id">This is a test</p>"""
+        assert "markdown-class" not in pg.html_text
+        assert "markdown-id" not in pg.html_text
 
 class TestGitHubWikiImporter: