Strip html comments from markdown (#8667)

NuGet · Jul 13, 2021 · 7557469 · 7557469
1 parent 2aebc2d
commit 7557469
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/src/NuGetGallery/Services/MarkdownService.cs b/src/NuGetGallery/Services/MarkdownService.cs
@@ -23,6 +23,7 @@ public class MarkdownService : IMarkdownService
         private static readonly TimeSpan RegexTimeout = TimeSpan.FromMinutes(1);
         private static readonly Regex EncodedBlockQuotePattern = new Regex("^ {0,3}&gt;", RegexOptions.Multiline, RegexTimeout);
         private static readonly Regex LinkPattern = new Regex("<a href=([\"\']).*?\\1", RegexOptions.None, RegexTimeout);
+        private static readonly Regex HtmlCommentPattern = new Regex("<!--.*?-->", RegexOptions.Singleline, RegexTimeout);
 
         private readonly IFeatureFlagService _features;
         private readonly IImageDomainValidator _imageDomainValidator;
@@ -82,10 +83,12 @@ private RenderedMarkdownResult GetHtmlFromMarkdownCommonMark(string markdownStri
                 ImageSourceDisallowed = false
             };
 
-            var readmeWithoutBom = markdownString.StartsWith("\ufeff") ? markdownString.Replace("\ufeff", "") : markdownString;
+            var markdownWithoutComments = HtmlCommentPattern.Replace(markdownString, "");
+
+            var markdownWithoutBom = markdownWithoutComments.StartsWith("\ufeff") ? markdownWithoutComments.Replace("\ufeff", "") : markdownWithoutComments;
 
             // HTML encode markdown, except for block quotes, to block inline html.
-            var encodedMarkdown = EncodedBlockQuotePattern.Replace(HttpUtility.HtmlEncode(readmeWithoutBom), "> ");
+            var encodedMarkdown = EncodedBlockQuotePattern.Replace(HttpUtility.HtmlEncode(markdownWithoutBom), "> ");
 
             var settings = CommonMarkSettings.Default.Clone();
             settings.RenderSoftLineBreaksAsLineBreaks = true;
@@ -189,7 +192,9 @@ private RenderedMarkdownResult GetHtmlFromMarkdownMarkdig(string markdownString,
                 ImageSourceDisallowed = false
             };
 
-            var readmeWithoutBom = markdownString.TrimStart('\ufeff');
+            var markdownWithoutComments = HtmlCommentPattern.Replace(markdownString, "");
+
+            var markdownWithoutBom = markdownWithoutComments.TrimStart('\ufeff');
 
             var pipeline = new MarkdownPipelineBuilder()
                 .UseGridTables()
@@ -208,7 +213,7 @@ private RenderedMarkdownResult GetHtmlFromMarkdownMarkdig(string markdownString,
                 var renderer = new HtmlRenderer(htmlWriter);
                 pipeline.Setup(renderer);
 
-                var document = Markdown.Parse(readmeWithoutBom, pipeline);
+                var document = Markdown.Parse(markdownWithoutBom, pipeline);
 
                 foreach (var node in document.Descendants())
                 {

diff --git a/tests/NuGetGallery.Facts/Services/MarkdownServiceFacts.cs b/tests/NuGetGallery.Facts/Services/MarkdownServiceFacts.cs
@@ -73,6 +73,8 @@ public void EncodesHtmlInMarkdownWithAdaptiveHeader(string originalMd, string ex
             [Theory]
             [InlineData("# Heading", "<h2>Heading</h2>", false, true)]
             [InlineData("# Heading", "<h2>Heading</h2>", false, false)]
+            [InlineData("<!-- foo --> <!-- foo \n bar --> baz", "<p>baz</p>", false, true)]
+            [InlineData("<!-- foo --> <!-- foo \n bar --> baz", "<p>baz</p>", false, false)]
             [InlineData("\ufeff# Heading with BOM", "<h2>Heading with BOM</h2>", false, true)]
             [InlineData("\ufeff# Heading with BOM", "<h2>Heading with BOM</h2>", false, false)]
             [InlineData("- List", "<ul>\n<li>List</li>\n</ul>", false, true)]