diff --git a/app/models/topic.rb b/app/models/topic.rb index 331496cc7a3..9c9f85cc6cd 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -71,7 +71,7 @@ class Topic < ActiveRecord::Base before_validation do if title.present? - self.title = sanitize(title) + self.title = sanitize(title, tags: [], attributes: []) self.title.strip! end end diff --git a/spec/models/topic_spec.rb b/spec/models/topic_spec.rb index 38782aca016..1991ff7124b 100644 --- a/spec/models/topic_spec.rb +++ b/spec/models/topic_spec.rb @@ -110,10 +110,20 @@ describe Topic do end context 'html in title' do - let(:topic) { Fabricate(:topic, title: " is my topic title" ) } + let(:topic_bold) { Fabricate(:topic, title: "topic with bold text in its title" ) } + let(:topic_image) { Fabricate(:topic, title: "topic with image in its title" ) } + let(:topic_script) { Fabricate(:topic, title: " is my topic title" ) } - it "should escape the HTML" do - topic.title.should == "is my topic title" + it "escapes script contents" do + topic_script.title.should == "is my topic title" + end + + it "escapes bold contents" do + topic_bold.title.should == "topic with bold text in its title" + end + + it "escapes bold contents" do + topic_image.title.should == "topic with image in its title" end end