diff --git a/app/models/topic.rb b/app/models/topic.rb
index 331496cc7a3..9c9f85cc6cd 100644
--- a/app/models/topic.rb
+++ b/app/models/topic.rb
@@ -71,7 +71,7 @@ class Topic < ActiveRecord::Base
before_validation do
if title.present?
- self.title = sanitize(title)
+ self.title = sanitize(title, tags: [], attributes: [])
self.title.strip!
end
end
diff --git a/spec/models/topic_spec.rb b/spec/models/topic_spec.rb
index 38782aca016..1991ff7124b 100644
--- a/spec/models/topic_spec.rb
+++ b/spec/models/topic_spec.rb
@@ -110,10 +110,20 @@ describe Topic do
end
context 'html in title' do
- let(:topic) { Fabricate(:topic, title: " is my topic title" ) }
+ let(:topic_bold) { Fabricate(:topic, title: "topic with bold text in its title" ) }
+ let(:topic_image) { Fabricate(:topic, title: "topic with image in its title" ) }
+ let(:topic_script) { Fabricate(:topic, title: " is my topic title" ) }
- it "should escape the HTML" do
- topic.title.should == "is my topic title"
+ it "escapes script contents" do
+ topic_script.title.should == "is my topic title"
+ end
+
+ it "escapes bold contents" do
+ topic_bold.title.should == "topic with bold text in its title"
+ end
+
+ it "escapes bold contents" do
+ topic_image.title.should == "topic with image in its title"
end
end