Merge pull request #12542 from anansilva/12448-sanitise-html-custom-tab

Sanitize HTML in custom tab content [read only]

app/models/custom_tab.rb

@@ -4,4 +4,14 @@ class CustomTab < ApplicationRecord
   belongs_to :enterprise
 
   validates :title, presence: true, length: { maximum: 20 }
+
+  # Remove any unsupported HTML.
+  def content
+    HtmlSanitizer.sanitize(super)
+  end
+
+  # Remove any unsupported HTML.
+  def content=(html)
+    super(HtmlSanitizer.sanitize(html))
+  end
 end

spec/models/custom_tab_spec.rb

@@ -12,4 +12,16 @@ RSpec.describe CustomTab do
 
     it { is_expected.to validate_length_of(:title).is_at_most(20) }
   end
+
+  describe "serialisation" do
+    it "sanitises HTML in content" do
+      subject.content = "Hello <script>alert</script> dearest <b>monster</b>."
+      expect(subject.content).to eq "Hello alert dearest <b>monster</b>."
+    end
+
+    it "sanitises existing HTML in content" do
+      subject[:content] = "Hello <script>alert</script> dearest <b>monster</b>."
+      expect(subject.content).to eq "Hello alert dearest <b>monster</b>."
+    end
+  end
 end