Merge pull request #12542 from anansilva/12448-sanitise-html-custom-tab

Sanitize HTML in custom tab content [read only]

app/models/custom_tab.rb

@@ -4,4 +4,14 @@ class CustomTab < ApplicationRecord
   belongs_to :enterprise
 
   validates :title, presence: true, length: { maximum: 20 }
+
+  # Remove any unsupported HTML.
+  def content
+    HtmlSanitizer.sanitize(super)
+  end
+
+  # Remove any unsupported HTML.
+  def content=(html)
+    super(HtmlSanitizer.sanitize(html))
+  end
 end