Add further testing for Highlight#sanitized_opts

lib/jekyll/tags/highlight.rb

@@ -59,20 +59,30 @@ eos
         prefix + rendered_output + suffix
       end
 
+      def sanitized_opts(opts, is_safe)
+        if is_safe
+          Hash[[
+            [:startinline, opts.fetch(:startinline, nil)],
+            [:hl_linenos,  opts.fetch(:hl_linenos, nil)],
+            [:linenos,     opts.fetch(:linenos, nil)],
+            [:encoding,    opts.fetch(:encoding, 'utf-8')],
+            [:cssclass,    opts.fetch(:cssclass, nil)]
+          ].reject {|f| f.last.nil? }]
+        else
+          opts
+        end
+      end
+
       def render_pygments(code, is_safe)
         require 'pygments'
 
-        if is_safe
-          @options = {
-            :startinline => @options.fetch(:startinline, nil),
-            :hl_lines    => @options.fetch(:hl_lines, nil),
-            :linenos     => @options.fetch(:linenos, nil)
-          }
-        end
-
         @options[:encoding] = 'utf-8'
 
-        highlighted_code = Pygments.highlight(code, :lexer => @lang, :options => @options)
+        highlighted_code = Pygments.highlight(
+          code,
+          :lexer   => @lang,
+          :options => sanitized_opts(@options, is_safe)
+        )
 
         if highlighted_code.nil?
           Jekyll.logger.error "There was an error highlighting your code:"

test/test_tags.rb

@@ -87,6 +87,37 @@ CONTENT
     end
   end
 
+  context "in safe mode" do
+    setup do
+      @tag = Jekyll::Tags::HighlightBlock.new('highlight', 'text ', ["test", "{% endhighlight %}", "\n"])
+    end
+
+    should "allow linenos" do
+      sanitized = @tag.sanitized_opts({:linenos => true}, true)
+      assert_equal true, sanitized[:linenos]
+    end
+
+    should "allow hl_linenos" do
+      sanitized = @tag.sanitized_opts({:hl_linenos => %w[1 2 3 4]}, true)
+      assert_equal %w[1 2 3 4], sanitized[:hl_linenos]
+    end
+
+    should "allow cssclass" do
+      sanitized = @tag.sanitized_opts({:cssclass => "ahoy"}, true)
+      assert_equal "ahoy", sanitized[:cssclass]
+    end
+
+    should "allow startinline" do
+      sanitized = @tag.sanitized_opts({:startinline => true}, true)
+      assert_equal true, sanitized[:startinline]
+    end
+
+    should "strip unknown options" do
+      sanitized = @tag.sanitized_opts({:light => true}, true)
+      assert_nil sanitized[:light]
+    end
+  end
+
   context "post content has highlight tag" do
     setup do
       fill_post("test")