View Issue Details

IDProjectCategoryView StatusLast Update
0022315mantisbtmarkdownpublic2017-12-04 02:25
ReporteruxmasterAssigned Tojoel 
PrioritynormalSeverityminorReproducibilityalways
Status assignedResolutionopen 
Product Version2.1.1 
Target Version2.10.0Fixed in Version 
Summary0022315: Markdown converts " to " within code blocks and inline code
Description

This is caused by noncooperation between "Markdown Processing" and "Text Processing".
When the latter is turned off, everything is OK (apart from XSS vulnerability).

Steps To Reproduce

" in normal text

" in inline code "

" in code block

"
TagsNo tags attached.

Relationships

related to 0022246 closedjoel Markdown is converting '&' signs to (ampersand[amp;]) inside code block or backtick as well 
has duplicate 0022407 closedatrol Quotes in markdown 
child of 0022180 new Markdown issues following implementation in 0017920 

Activities

rombert

rombert

2017-02-14 08:51

developer   ~0055670

Confirmed, seeing this as well

joel

joel

2017-02-19 08:29

developer   ~0055719

This has been addressed already with this PR https://github.com/mantisbt/mantisbt/pull/1007

dregad

dregad

2017-02-23 12:29

developer   ~0055768

This one is really annoying, can't copy/paste code snippets anymore without having to manually replace " entities by actual quotes ...

joel

joel

2017-02-27 18:47

developer   ~0055812

Last edited: 2017-02-27 18:48

View 2 revisions

This is not a bug in upstream, the bug is due to that Text processing process the text from the start:

  1. Text processing converts & sign into entity name (ampersand[amp;]) within the code block or backtick
  2. With that, we need to convert back the entity name back to its result within the specific function in the extension class.

And this is the PR https://github.com/mantisbt/mantisbt/pull/1007

ajtruckle

ajtruckle

2017-03-03 05:41

reporter   ~0055890

@joel Which version of the MantisBT download do I use that has this fix?

atrol

atrol

2017-03-03 05:46

developer   ~0055891

@ajtruckle this is an open PR, so there is no version you can download at the moment.

Issue History

Date Modified Username Field Change
2017-02-04 09:49 uxmaster New Issue
2017-02-14 08:51 rombert Status new => confirmed
2017-02-14 08:51 rombert Note Added: 0055670
2017-02-14 10:11 atrol Relationship added child of 0022180
2017-02-19 08:29 joel Note Added: 0055719
2017-02-19 08:32 joel Relationship added related to 0022246
2017-02-19 12:55 joel Assigned To => joel
2017-02-19 12:55 joel Status confirmed => assigned
2017-02-22 05:15 atrol Relationship added has duplicate 0022407
2017-02-23 12:28 dregad Product Version 2.1.0 => 2.1.1
2017-02-23 12:28 dregad Target Version => 2.2.0
2017-02-23 12:28 dregad Summary Markdown converts " to " within code blocks and inline code => Markdown converts " to " within code blocks and inline code
2017-02-23 12:28 dregad Additional Information Updated View Revisions
2017-02-23 12:29 dregad Additional Information Updated View Revisions
2017-02-23 12:29 dregad Note Added: 0055768
2017-02-26 21:19 vboctor Target Version 2.2.0 => 2.3.0
2017-02-27 18:47 joel Note Added: 0055812
2017-02-27 18:48 joel Note Edited: 0055812 View Revisions
2017-03-03 05:41 ajtruckle Note Added: 0055890
2017-03-03 05:46 atrol Note Added: 0055891
2017-04-01 00:20 vboctor Target Version 2.3.0 => 2.4.0
2017-04-30 14:53 vboctoradmin Target Version 2.4.0 => 2.5.0
2017-06-04 16:19 atrol Target Version 2.5.0 => 2.6.0
2017-09-03 18:49 vboctor Target Version 2.6.0 => 2.7.0
2017-10-08 23:55 vboctor Target Version 2.7.0 => 2.8.0
2017-10-28 19:14 vboctor Target Version 2.8.0 => 2.9.0
2017-12-04 02:25 vboctor Target Version 2.9.0 => 2.10.0