Sanitise existing HTML in Enterprise#long_description

We will add a migration to sanitise all existing descriptions but before
we do that destructive action, it's good to test this in a read-only
fashion first.
This commit is contained in:
Maikel Linke
2024-05-14 12:25:58 +10:00
parent 7b4a85f7ef
commit 23a27c65be
2 changed files with 10 additions and 0 deletions

View File

@@ -247,6 +247,11 @@ class Enterprise < ApplicationRecord
count(distinct: true)
end
# Remove any unsupported HTML.
def long_description
HtmlSanitizer.sanitize(super)
end
# Remove any unsupported HTML.
def long_description=(html)
super(HtmlSanitizer.sanitize(html))

View File

@@ -403,6 +403,11 @@ RSpec.describe Enterprise do
subject.long_description = "Hello <script>alert</script> dearest <b>monster</b>."
expect(subject.long_description).to eq "Hello alert dearest <b>monster</b>."
end
it "sanitises existing HTML in long_description" do
subject[:long_description] = "Hello <script>alert</script> dearest <b>monster</b>."
expect(subject.long_description).to eq "Hello alert dearest <b>monster</b>."
end
end
describe "callbacks" do