From 5304fa6bf491d0e4a9693809c374f9e0a2e0b235 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Sun, 3 Jun 2018 10:29:57 +0800
Subject: [PATCH 1/2] add csv file render support defaultly

---
 main.go                   |  1 +
 modules/markup/csv/csv.go | 57 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 modules/markup/csv/csv.go

diff --git a/main.go b/main.go
index 179132f58798c..e73f1d60a922c 100644
--- a/main.go
+++ b/main.go
@@ -14,6 +14,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	// register supported doc types
+	_ "code.gitea.io/gitea/modules/markup/csv"
 	_ "code.gitea.io/gitea/modules/markup/markdown"
 	_ "code.gitea.io/gitea/modules/markup/orgmode"
 
diff --git a/modules/markup/csv/csv.go b/modules/markup/csv/csv.go
new file mode 100644
index 0000000000000..5d14a58958d0b
--- /dev/null
+++ b/modules/markup/csv/csv.go
@@ -0,0 +1,57 @@
+// Copyright 2018 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package markup
+
+import (
+	"bytes"
+	"encoding/csv"
+	"io"
+
+	"code.gitea.io/gitea/modules/markup"
+)
+
+func init() {
+	markup.RegisterParser(Parser{})
+}
+
+// Parser implements markup.Parser for orgmode
+type Parser struct {
+}
+
+// Name implements markup.Parser
+func (Parser) Name() string {
+	return "csv"
+}
+
+// Extensions implements markup.Parser
+func (Parser) Extensions() []string {
+	return []string{".csv"}
+}
+
+// Render implements markup.Parser
+func (Parser) Render(rawBytes []byte, urlPrefix string, metas map[string]string, isWiki bool) []byte {
+	rd := csv.NewReader(bytes.NewReader(rawBytes))
+	var tmpBlock bytes.Buffer
+	tmpBlock.WriteString(`<table class="table">`)
+	for {
+		fields, err := rd.Read()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			continue
+		}
+		tmpBlock.WriteString("<tr>")
+		for _, field := range fields {
+			tmpBlock.WriteString("<td>")
+			tmpBlock.WriteString(field)
+			tmpBlock.WriteString("</td>")
+		}
+		tmpBlock.WriteString("<tr>")
+	}
+	tmpBlock.WriteString("</table>")
+
+	return tmpBlock.Bytes()
+}

From 8da44d1844a59f3be47896a5033bcf603b1fd945 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Fri, 20 Jul 2018 10:20:36 +0800
Subject: [PATCH 2/2] escaping csv column content

---
 modules/markup/csv/csv.go      |  3 ++-
 modules/markup/csv/csv_test.go | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 modules/markup/csv/csv_test.go

diff --git a/modules/markup/csv/csv.go b/modules/markup/csv/csv.go
index 5d14a58958d0b..077947e774425 100644
--- a/modules/markup/csv/csv.go
+++ b/modules/markup/csv/csv.go
@@ -7,6 +7,7 @@ package markup
 import (
 	"bytes"
 	"encoding/csv"
+	"html"
 	"io"
 
 	"code.gitea.io/gitea/modules/markup"
@@ -46,7 +47,7 @@ func (Parser) Render(rawBytes []byte, urlPrefix string, metas map[string]string,
 		tmpBlock.WriteString("<tr>")
 		for _, field := range fields {
 			tmpBlock.WriteString("<td>")
-			tmpBlock.WriteString(field)
+			tmpBlock.WriteString(html.EscapeString(field))
 			tmpBlock.WriteString("</td>")
 		}
 		tmpBlock.WriteString("<tr>")
diff --git a/modules/markup/csv/csv_test.go b/modules/markup/csv/csv_test.go
new file mode 100644
index 0000000000000..f050296cee1bb
--- /dev/null
+++ b/modules/markup/csv/csv_test.go
@@ -0,0 +1,25 @@
+// Copyright 2018 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package markup
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRenderCSV(t *testing.T) {
+	var parser Parser
+	var kases = map[string]string{
+		"a":     "<table class=\"table\"><tr><td>a</td><tr></table>",
+		"1,2":   "<table class=\"table\"><tr><td>1</td><td>2</td><tr></table>",
+		"<br/>": "<table class=\"table\"><tr><td>&lt;br/&gt;</td><tr></table>",
+	}
+
+	for k, v := range kases {
+		res := parser.Render([]byte(k), "", nil, false)
+		assert.EqualValues(t, v, string(res))
+	}
+}