Make debate.description always html_safe

This commit is contained in:
kikito
2015-08-04 18:42:49 +02:00
parent 1fa4087bef
commit 87dd655d70
2 changed files with 19 additions and 8 deletions

View File

@@ -35,6 +35,10 @@ class Debate < ActiveRecord::Base
editable? && author == user
end
def description
super.try :html_safe
end
protected
def sanitize_description

View File

@@ -20,15 +20,22 @@ describe Debate do
expect(@debate).to_not be_valid
end
it "should not be valid without a description" do
@debate.description = nil
expect(@debate).to_not be_valid
end
describe "#description" do
it "should be mandatory" do
@debate.description = nil
expect(@debate).to_not be_valid
end
it "should sanitize the description" do
@debate.description = "<script>alert('danger');</script>"
@debate.valid?
expect(@debate.description).to eq("alert('danger');")
it "should be sanitized" do
@debate.description = "<script>alert('danger');</script>"
@debate.valid?
expect(@debate.description).to eq("alert('danger');")
end
it "should be html_safe" do
@debate.description = "<script>alert('danger');</script>"
expect(@debate.description).to be_html_safe
end
end
it "should sanitize the tag list" do