CVE-2021-28834

@@ -70,7 +70,7 @@ def self.formatter_class(opts = {})
       when Class
         formatter
       when /\A[[:upper:]][[:alnum:]_]*\z/
-        ::Rouge::Formatters.const_get(formatter)
+        ::Rouge::Formatters.const_get(formatter, false)
       else
         # Available in Rouge 2.0 or later
         ::Rouge::Formatters::HTMLLegacy

@@ -21,16 +21,20 @@
   end
 
   # custom formatter for tests
-  class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class
+  module Rouge
+    module Formatters
+      class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class
 
-    tag 'rouge_html_formatters'
+        tag 'rouge_html_formatters'
 
-    def stream(tokens, &b)
-      yield %(<div class="custom-class">)
-      super
-      yield %(</div>)
-    end
+        def stream(tokens, &b)
+          yield %(<div class="custom-class">)
+          super
+          yield %(</div>)
+        end
 
+      end
+    end
   end
 rescue LoadError, SyntaxError, NameError
 end

@@ -25,8 +25,8 @@ formatter
 : A custom Rouge formatter class that should be used instead of the following default formatter
   (Rogue 1.x: `Rouge::Formatters::HTML` / Rogue 2.x: `Rouge::Formatters::HTMLLegacy`).
 
-  Note that setting this key only makes sense using Ruby code because the value needs to be a class
-  object!
+  If this setting is a string, it needs to contain the name of a constant under the
+  `Rouge::Formatters` namespace.
 
 disable
 : If set to `true`, highlighting with Rouge will be disabled.

@@ -17,14 +17,6 @@ module Rouge
 
       # Highlighting via Rouge is available if this constant is +true+.
       AVAILABLE = true
-
-      begin
-        # Rouge::Formatters::HTMLLegacy is available on Rouge 2.0 or later
-        FORMATTER_CLASS = ::Rouge::Formatters::HTMLLegacy
-      rescue NameError
-        # Fallbacks to Rouge 1.x formatter if Rouge::Formatters::HTMLLegacy is not available
-        FORMATTER_CLASS = ::Rouge::Formatters::HTML
-      end
     rescue LoadError, SyntaxError
       AVAILABLE = false  # :nodoc:
     end
@@ -35,7 +27,7 @@ def self.call(converter, text, lang, type, call_opts)
       lexer = ::Rouge::Lexer.find_fancy(lang || opts[:default_lang], text)
       return nil if opts[:disable] || !lexer
       opts[:css_class] ||= 'highlight' # For backward compatibility when using Rouge 2.0
-      formatter = (opts.fetch(:formatter, FORMATTER_CLASS)).new(opts)
+      formatter = formatter_class(opts).new(opts)
       formatter.format(lexer.lex(text))
     end
 
@@ -62,6 +54,21 @@ def self.prepare_options(converter)
       cache[:block] = opts.merge(block_opts)
     end
 
+    def self.formatter_class(opts = {})
+      case formatter = opts[:formatter]
+      when Class
+        formatter
+      when /\A[[:upper:]][[:alnum:]_]*\z/
+        ::Rouge::Formatters.const_get(formatter)
+      else
+        # Available in Rouge 2.0 or later
+        ::Rouge::Formatters::HTMLLegacy
+      end
+    rescue NameError
+      # Fallback to Rouge 1.x
+      ::Rouge::Formatters::HTML
+    end
+
   end
 
 end

@@ -1,4 +1,4 @@
 :syntax_highlighter: rouge
 :syntax_highlighter_opts:
   default_lang: ruby
-  formatter: !ruby/class 'RougeHTMLFormatters'
+  formatter: RougeHTMLFormatters

@@ -15,14 +15,12 @@
 begin
   require 'kramdown/converter/syntax_highlighter/rouge'
 
-  class Kramdown::Converter::SyntaxHighlighter::Rouge::FORMATTER_CLASS
-    def format(tokens, &b)
-      super.sub(/<\/code><\/pre>\n?/, "</code></pre>\n")
-    end
+  Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class.send(:define_method, :format) do |tokens, &b|
+    super(tokens, &b).sub(/<\/code><\/pre>\n?/, "</code></pre>\n")
   end
 
   # custom formatter for tests
-  class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge::FORMATTER_CLASS
+  class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class
     tag 'rouge_html_formatters'
 
     def stream(tokens, &b)