diff --git a/app/views/debates/show.html.erb b/app/views/debates/show.html.erb index 83c37964a..a86efed99 100644 --- a/app/views/debates/show.html.erb +++ b/app/views/debates/show.html.erb @@ -57,7 +57,7 @@ - <%= @debate.description %> + <%= safe_html_with_links @debate.description %> <%= render 'shared/tags', debate: @debate %> diff --git a/spec/features/debates_spec.rb b/spec/features/debates_spec.rb index 79e6486c0..45acc0a6f 100644 --- a/spec/features/debates_spec.rb +++ b/spec/features/debates_spec.rb @@ -138,6 +138,48 @@ feature 'Debates' do expect(page.html).to_not include '<p>This is' end + scenario 'Autolinking is applied to description' do + author = create(:user) + login_as(author) + + visit new_debate_path + fill_in 'debate_title', with: 'Testing auto link' + fill_in 'debate_description', with: '
This is a link www.example.org
' + fill_in 'debate_captcha', with: correct_captcha_text + check 'debate_terms_of_service' + + click_button 'Start a debate' + + expect(page).to have_content 'Debate was successfully created.' + expect(page).to have_content 'Testing auto link' + expect(page).to have_link('www.example.org', href: 'http://www.example.org') + end + + scenario 'JS injection is prevented but autolinking is respected' do + author = create(:user) + login_as(author) + + visit new_debate_path + fill_in 'debate_title', with: 'Testing auto link' + fill_in 'debate_description', with: " click me http://example.org" + fill_in 'debate_captcha', with: correct_captcha_text + check 'debate_terms_of_service' + + click_button 'Start a debate' + + expect(page).to have_content 'Debate was successfully created.' + expect(page).to have_content 'Testing auto link' + expect(page).to have_link('http://example.org', href: 'http://example.org') + expect(page).not_to have_link('click me') + expect(page.html).to_not include "" + + click_link 'Edit' + + expect(current_path).to eq edit_debate_path(Debate.last) + expect(page).not_to have_link('click me') + expect(page.html).to_not include "" + end + context 'Tagging debates' do let(:author) { create(:user) }