Filter image tags everywhere except in custom pages

Allowing image tags everywhere makes us vulnerable to CSRF attacks.

spec/lib/admin_wysiwyg_sanitizer_spec.rb

@@ -0,0 +1,12 @@
+require 'rails_helper'
+
+describe AdminWYSIWYGSanitizer do
+  let(:sanitizer) { AdminWYSIWYGSanitizer.new }
+
+  describe '#sanitize' do
+    it 'allows images' do
+      html = 'Dangerous<img src="/smile.png" alt="Smile" style="width: 10px;"> image'
+      expect(sanitizer.sanitize(html)).to eq(html)
+    end
+  end
+end

spec/lib/wysiwyg_sanitizer_spec.rb

@@ -15,10 +15,25 @@ describe WYSIWYGSanitizer do
       expect(subject.sanitize(html)).to eq(html)
     end
 
+    it 'allows links' do
+      html = '<p><a href="/">Home</a></p>'
+      expect(subject.sanitize(html)).to eq(html)
+    end
+
+    it 'allows headings' do
+      html = '<h2>Objectives</h2><p>Fix flaky specs</p><h3>Explain why the test is flaky</h3>'
+      expect(subject.sanitize(html)).to eq(html)
+    end
+
     it 'filters out dangerous tags' do
       html = '<p>This is <script>alert("dangerous");</script></p>'
       expect(subject.sanitize(html)).to eq('<p>This is alert("dangerous");</p>')
     end
+
+    it 'filters images' do
+      html = 'Dangerous<img src="/smile.png" alt="Smile" style="width: 10px";> image'
+      expect(subject.sanitize(html)).to eq('Dangerous image')
+    end
   end
 
 end