Sanitize label texts automatically

This way we can remove all those `html_safe` calls and we avoid
potential XSS attacks in label texts.
This commit is contained in:
Javi Martín
2019-10-05 16:42:43 +02:00
parent 2586229e38
commit 75a28fafcb
9 changed files with 27 additions and 7 deletions

View File

@@ -1,4 +1,6 @@
class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
include ActionView::Helpers::SanitizeHelper
def enum_select(attribute, options = {}, html_options = {})
choices = object.class.send(attribute.to_s.pluralize).keys.map do |name|
[object.class.human_attribute_name("#{attribute}.#{name}"), name]
@@ -35,6 +37,14 @@ class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
private
def custom_label(attribute, text, options)
if text == false
super
else
super(attribute, sanitize(label_text(object, attribute, text)), options)
end
end
def label_with_hint(attribute, options)
custom_label(attribute, options[:label], options[:label_options]) +
help_text(attribute, options)