Make debate.description always html_safe
This commit is contained in:
@@ -35,6 +35,10 @@ class Debate < ActiveRecord::Base
|
||||
editable? && author == user
|
||||
end
|
||||
|
||||
def description
|
||||
super.try :html_safe
|
||||
end
|
||||
|
||||
protected
|
||||
|
||||
def sanitize_description
|
||||
|
||||
@@ -20,15 +20,22 @@ describe Debate do
|
||||
expect(@debate).to_not be_valid
|
||||
end
|
||||
|
||||
it "should not be valid without a description" do
|
||||
@debate.description = nil
|
||||
expect(@debate).to_not be_valid
|
||||
end
|
||||
describe "#description" do
|
||||
it "should be mandatory" do
|
||||
@debate.description = nil
|
||||
expect(@debate).to_not be_valid
|
||||
end
|
||||
|
||||
it "should sanitize the description" do
|
||||
@debate.description = "<script>alert('danger');</script>"
|
||||
@debate.valid?
|
||||
expect(@debate.description).to eq("alert('danger');")
|
||||
it "should be sanitized" do
|
||||
@debate.description = "<script>alert('danger');</script>"
|
||||
@debate.valid?
|
||||
expect(@debate.description).to eq("alert('danger');")
|
||||
end
|
||||
|
||||
it "should be html_safe" do
|
||||
@debate.description = "<script>alert('danger');</script>"
|
||||
expect(@debate.description).to be_html_safe
|
||||
end
|
||||
end
|
||||
|
||||
it "should sanitize the tag list" do
|
||||
|
||||
Reference in New Issue
Block a user