mirror of
https://github.com/openfoodfoundation/openfoodnetwork
synced 2026-01-31 21:37:16 +00:00
Sanitise existing HTML in Enterprise#long_description
We will add a migration to sanitise all existing descriptions but before we do that destructive action, it's good to test this in a read-only fashion first.
This commit is contained in:
@@ -247,6 +247,11 @@ class Enterprise < ApplicationRecord
|
||||
count(distinct: true)
|
||||
end
|
||||
|
||||
# Remove any unsupported HTML.
|
||||
def long_description
|
||||
HtmlSanitizer.sanitize(super)
|
||||
end
|
||||
|
||||
# Remove any unsupported HTML.
|
||||
def long_description=(html)
|
||||
super(HtmlSanitizer.sanitize(html))
|
||||
|
||||
@@ -403,6 +403,11 @@ RSpec.describe Enterprise do
|
||||
subject.long_description = "Hello <script>alert</script> dearest <b>monster</b>."
|
||||
expect(subject.long_description).to eq "Hello alert dearest <b>monster</b>."
|
||||
end
|
||||
|
||||
it "sanitises existing HTML in long_description" do
|
||||
subject[:long_description] = "Hello <script>alert</script> dearest <b>monster</b>."
|
||||
expect(subject.long_description).to eq "Hello alert dearest <b>monster</b>."
|
||||
end
|
||||
end
|
||||
|
||||
describe "callbacks" do
|
||||
|
||||
Reference in New Issue
Block a user