-
Notifications
You must be signed in to change notification settings - Fork 3
Fix and improve highlighting with highlight.js #435
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
xoxys
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mmattel I would definitely not recommend it.
| * See: https://github.com/highlightjs/highlight.js/wiki/security | ||
| * A hljs command has been added in partials/footer-scripts.hbs | ||
| * hljs.configure({ ignoreUnescapedHTML: true }) | ||
| * This is not a security issue for us as we have a static site |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That is simply not true. Someone could sneak in evil code in a docs PR, and it can get merged by someone who is not aware of this potential issue. Why not simply escape the HTML within code blocks as recommended? There is no real reason to disable security mechanisms.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ok, thanks for the insight. I will open a new issue.
References: owncloud/docs-server#94 ([QA] Manual copy / paste misses redirects)
References: owncloud/docs#4707 (Add info for the correct use of the source langauge)
Description:
console(shell.js) andbash(bash.js). Whilebashhighlights any recognized bash keyword word from the beginning and let this also be selectable via CSS in the browser,consolerequires mandatory a bash promt at the beginning to highlight bash keywords correctly - but additionally disables the bash prompt as selectable component in the browserphpen/dismodorwgetect, see: Adding Keywords to a Language at Startup. Some keywords are added in advance like thea2xxxcommands and will automatically be highlighted when the next release of highlight.js gets published, see: enh(bash)$pattern: allow numbers after the first character highlightjs/highlight.js#3494occkeyword has been added to the above listNOTE:
Examples:
(The examples below already reflect a correct language used)
@jnweiger fyi