Fix #3497: Invalid DText denial of service attack.

2018-01-14 14:22:10 -06:00
parent 4f543671a2
commit 88f4a56890
5 changed files with 19 additions and 7 deletions
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -51,10 +51,12 @@ module ApplicationHelper

  def format_text(text, **options)
    raw DTextRagel.parse(text, **options)
+  rescue DTextRagel::Error => e
+    raw ""
  end

  def strip_dtext(text)
-    raw(DTextRagel.parse_strip(text))
+    format_text(text, strip: true)
  end

  def error_messages_for(instance_name)