-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix and improve highlighting with highlight.js #435
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mmattel I would definitely not recommend it.
* See: https://github.com/highlightjs/highlight.js/wiki/security | ||
* A hljs command has been added in partials/footer-scripts.hbs | ||
* hljs.configure({ ignoreUnescapedHTML: true }) | ||
* This is not a security issue for us as we have a static site |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That is simply not true. Someone could sneak in evil code in a docs PR, and it can get merged by someone who is not aware of this potential issue. Why not simply escape the HTML within code blocks as recommended? There is no real reason to disable security mechanisms.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ok, thanks for the insight. I will open a new issue.
References: owncloud/docs-server#94 ([QA] Manual copy / paste misses redirects)
References: owncloud/docs#4707 (Add info for the correct use of the source langauge)
Description:
console
(shell.js) andbash
(bash.js). Whilebash
highlights any recognized bash keyword word from the beginning and let this also be selectable via CSS in the browser,console
requires mandatory a bash promt at the beginning to highlight bash keywords correctly - but additionally disables the bash prompt as selectable component in the browserphpen/dismod
orwget
ect, see: Adding Keywords to a Language at Startup. Some keywords are added in advance like thea2xxx
commands and will automatically be highlighted when the next release of highlight.js gets published, see: enh(bash)$pattern
: allow numbers after the first character highlightjs/highlight.js#3494occ
keyword has been added to the above listNOTE:
Examples:
(The examples below already reflect a correct language used)
@jnweiger fyi