From 570e3b3e791a78ed9ac69bb561f8bfa307f75129 Mon Sep 17 00:00:00 2001 From: Robin Ward Date: Wed, 17 Sep 2014 12:08:00 -0400 Subject: [PATCH] SECURITY: Stripping links could unescape html fragments --- lib/pretty_text.rb | 2 +- spec/components/pretty_text_spec.rb | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/pretty_text.rb b/lib/pretty_text.rb index 57c9071e5ab..6d52705a1f8 100644 --- a/lib/pretty_text.rb +++ b/lib/pretty_text.rb @@ -250,7 +250,7 @@ module PrettyText # If the user is not basic, strip links from their bio fragment = Nokogiri::HTML.fragment(string) - fragment.css('a').each {|a| a.replace(a.text) } + fragment.css('a').each {|a| a.replace(a.inner_html) } fragment.to_html end diff --git a/spec/components/pretty_text_spec.rb b/spec/components/pretty_text_spec.rb index 4becd6eb60c..e8b8b5871cd 100644 --- a/spec/components/pretty_text_spec.rb +++ b/spec/components/pretty_text_spec.rb @@ -210,6 +210,10 @@ describe PrettyText do it "strips links but leaves the text content" do expect(PrettyText.strip_links("I'm the linked batman")).to eq("I'm the linked batman") end + + it "escapes the text content" do + expect(PrettyText.strip_links("I'm the linked <batman>")).to eq("I'm the linked <batman>") + end end describe "make_all_links_absolute" do