Sanitize label texts automatically

This way we can remove all those `html_safe` calls and we avoid
potential XSS attacks in label texts.

app/views/budgets/investments/_form.html.erb

@@ -93,7 +93,8 @@
           title: t("form.accept_terms_title"),
           label: t("form.accept_terms",
                    policy: link_to(t("form.policy"), "/privacy", target: "blank"),
-                   conditions: link_to(t("form.conditions"), "/conditions", target: "blank")).html_safe %>
+                   conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
+                  ) %>
       </div>
 
     <% end %>

app/views/debates/_form.html.erb

@@ -39,7 +39,7 @@
           label: t("form.accept_terms",
                    policy: link_to(t("form.policy"), "/privacy", target: "blank"),
                    conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
-                  ).html_safe %>
+                  ) %>
       <% end %>
     </div>
 

app/views/legislation/proposals/_form.html.erb

@@ -65,7 +65,7 @@
           label: t("form.accept_terms",
                    policy: link_to(t("form.policy"), "/privacy", target: "blank"),
                    conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
-                  ).html_safe %>
+                  ) %>
       <% end %>
     </div>
 

app/views/organizations/registrations/new.html.erb

@@ -34,7 +34,7 @@
                                 "/conditions",
                                 title: t("shared.target_blank"),
                                 target: "_blank")
-                ).html_safe %>
+                ) %>
 
       <div class="small-12 medium-6 small-centered">
         <%= f.submit t("devise_views.organizations.registrations.new.submit"), class: "button expanded" %>

app/views/proposals/_form.html.erb

@@ -100,7 +100,7 @@
           label: t("form.accept_terms",
                    policy: link_to(t("form.policy"), "/privacy", target: "blank"),
                    conditions: link_to(t("form.conditions"), "/conditions", target: "blank")
-                  ).html_safe %>
+                  ) %>
       <% end %>
     </div>
 

app/views/users/registrations/new.html.erb

@@ -42,7 +42,7 @@
                  terms: link_to(t("devise_views.users.registrations.new.terms_link"), "/conditions",
                                 title: t("shared.target_blank"),
                                 target: "_blank")
-                ).html_safe %>
+                ) %>
 
       <div class="small-12 medium-6 small-centered">
         <%= f.submit t("devise_views.users.registrations.new.submit"), class: "button expanded" %>

app/views/verification/residence/new.html.erb

@@ -80,7 +80,7 @@
                    terms_url: link_to(t("verification.residence.new.terms"), "/census_terms",
                                       title: t("shared.target_blank"),
                                       target: "_blank")
-                  ).html_safe %>
+                  ) %>
       </div>
 
       <div class="small-12 medium-3 clear">

lib/consul_form_builder.rb

@@ -1,4 +1,6 @@
 class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
+  include ActionView::Helpers::SanitizeHelper
+
   def enum_select(attribute, options = {}, html_options = {})
     choices = object.class.send(attribute.to_s.pluralize).keys.map do |name|
       [object.class.human_attribute_name("#{attribute}.#{name}"), name]
@@ -35,6 +37,14 @@ class ConsulFormBuilder < FoundationRailsHelper::FormBuilder
 
   private
 
+    def custom_label(attribute, text, options)
+      if text == false
+        super
+      else
+        super(attribute, sanitize(label_text(object, attribute, text)), options)
+      end
+    end
+
     def label_with_hint(attribute, options)
       custom_label(attribute, options[:label], options[:label_options]) +
         help_text(attribute, options)

spec/features/xss_spec.rb

@@ -31,6 +31,15 @@ describe "Cross-Site Scripting protection", :js do
     expect(page.text).not_to be_empty
   end
 
+  scenario "accept terms label" do
+    I18nContent.create(key: "form.accept_terms", value: attack_code)
+
+    login_as(create(:user))
+    visit new_debate_path
+
+    expect(page.text).not_to be_empty
+  end
+
   scenario "proposal actions in dashboard" do
     proposal = create(:proposal)