ASCIIDOCTOR formatter: suppress embedded HTML

By default the ASCIIDOCTOR formatter now suppresses HTML that is
embedded in asciidoc by using '++++' blocks. Administrators can allow
embedded HTML by setting formatter.ASCIIDOCTOR.allowHtml to true in
the plugin configuration file, but allowing HTML is a security risk.

Change-Id: Idb283e6f93c543aca7944476dae954204a5bce23
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>

src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/AsciidoctorFormatter.java

diff --git a/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/AsciidoctorFormatter.java b/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/AsciidoctorFormatter.java
index b0611c7..367dc7c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/AsciidoctorFormatter.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/AsciidoctorFormatter.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.xdocs.formatter;
 
+import static com.googlesource.gerrit.plugins.xdocs.XDocGlobalConfig.KEY_ALLOW_HTML;
 import static com.googlesource.gerrit.plugins.xdocs.XDocGlobalConfig.KEY_APPEND_CSS;
 import static com.googlesource.gerrit.plugins.xdocs.XDocGlobalConfig.KEY_INCLUDE_TOC;
 import static java.nio.charset.StandardCharsets.UTF_8;
@@ -35,12 +36,14 @@
 import org.asciidoctor.SafeMode;
 import org.eclipse.jgit.util.TemporaryBuffer;
 
+import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.StringReader;
 import java.net.URL;
 import java.util.Properties;
 
@@ -71,6 +74,10 @@
   @Override
   public String format(String projectName, String revision,
       ConfigSection globalCfg, String raw) throws IOException {
+    if (!globalCfg.getBoolean(KEY_ALLOW_HTML, false)) {
+      raw = suppressHtml(raw);
+    }
+
     ConfigSection projectCfg =
         formatters.getFormatterConfig(globalCfg.getSubsection(), projectName);
     // asciidoctor ignores all attributes if no output file is specified,
@@ -99,6 +106,24 @@
     }
   }
 
+  private String suppressHtml(String raw) throws IOException {
+    try (BufferedReader br = new BufferedReader(new StringReader(raw))) {
+      StringBuilder sb = new StringBuilder();
+      boolean embeddedHtml = false;
+      String line;
+      while ((line = br.readLine()) != null) {
+        if (line.startsWith("++++")) {
+          embeddedHtml = !embeddedHtml;
+        }
+        if (!embeddedHtml && !line.startsWith("++++")) {
+          sb.append(line);
+          sb.append("\n");
+        }
+      }
+      return sb.toString();
+    }
+  }
+
   private Options createOptions(ConfigSection cfg, String revision, File out) {
     return OptionsBuilder.options()
         .backend(BACKEND)

src/main/resources/Documentation/config.md

diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index 02e7d75..59be517 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -160,7 +160,7 @@
 
 	*CANNOT* be overridden on project-level.
 
-	Supported for the following formatters: `MARKDOWN`
+	Supported for the following formatters: `ASCIIDOCTOR`, `MARKDOWN`
 
 	Default: `false`