mirror of
https://github.com/discourse/discourse.git
synced 2024-11-27 03:53:45 +08:00
df3eb93973
* DEV: Sanitize HTML admin inputs
This PR adds on-save HTML sanitization for:
Client site settings
translation overrides
badges descriptions
user fields descriptions
I used Rails's SafeListSanitizer, which [accepts the following HTML tags and attributes](018cf54073/lib/rails/html/sanitizer.rb (L108))
* Make sure that the sanitization logic doesn't corrupt settings with special characters
25 lines
754 B
Ruby
25 lines
754 B
Ruby
# frozen_string_literal: true
|
|
|
|
require 'rails_helper'
|
|
|
|
describe UserField do
|
|
describe "doesn't validate presence of name if field type is 'confirm'" do
|
|
subject { described_class.new(field_type: 'confirm') }
|
|
it { is_expected.not_to validate_presence_of :name }
|
|
end
|
|
|
|
describe "validates presence of name for other field types" do
|
|
subject { described_class.new(field_type: 'dropdown') }
|
|
it { is_expected.to validate_presence_of :name }
|
|
end
|
|
|
|
it 'sanitizes the description' do
|
|
xss = "<b onmouseover=alert('Wufff!')>click me!</b><script>alert('TEST');</script>"
|
|
user_field = Fabricate(:user_field)
|
|
|
|
user_field.update!(description: xss)
|
|
|
|
expect(user_field.description).to eq("<b>click me!</b>alert('TEST');")
|
|
end
|
|
end
|