Add proper filtering for inappropriate tags in listings (#2611)

app/labor/markdown_parser.rb

@@ -58,6 +58,19 @@ class MarkdownParser
                                             attributes: allowed_attributes
   end
 
+  def evaluate_listings_markdown
+    return if @content.blank?
+
+    renderer = Redcarpet::Render::HTMLRouge.new(hard_wrap: true, filter_html: false)
+    markdown = Redcarpet::Markdown.new(renderer, REDCARPET_CONFIG)
+    allowed_tags = %w[strong abbr aside em p h1 h2 h3 h4 h5 h6 i u b code pre
+                      br ul ol li small sup sub a span hr blockquote kbd]
+    allowed_attributes = %w[href strong em ref rel src title alt class]
+    ActionController::Base.helpers.sanitize markdown.render(@content).html_safe,
+                                            tags: allowed_tags,
+                                            attributes: allowed_attributes
+  end
+
   def tags_used
     return [] if @content.blank?
 

app/models/classified_listing.rb

@@ -71,8 +71,7 @@ class ClassifiedListing < ApplicationRecord
   private
 
   def evaluate_markdown
-    parsed_markdown = MarkdownParser.new(body_markdown)
-    self.processed_html = parsed_markdown.finalize
+    self.processed_html = MarkdownParser.new(body_markdown).evaluate_listings_markdown
   end
 
   def modify_inputs

spec/models/classified_listing_spec.rb

@@ -17,13 +17,19 @@ RSpec.describe ClassifiedListing, type: :model do
       expect(classified_listing.valid?).to eq(true)
     end
 
+    it "cleans images" do
+      classified_listing.body_markdown = "hello <img src='/dssdsdsd.jpg' /> hey hey hey"
+      classified_listing.save
+      expect(classified_listing.processed_html).not_to include("<img>")
+    end
+
     it "doesn't accept more than 8 tags" do
       classified_listing.tag_list = "a, b, c, d, e, f, g, h, z, t, s, p"
       expect(classified_listing.valid?).to eq(false)
       expect(classified_listing.errors[:tag_list]).to be_truthy
     end
 
-    it "parses away spaces" do
+    it "parses away tag spaces" do
       classified_listing.tag_list = "the best, tag list"
       classified_listing.save
       expect(classified_listing.tag_list).to eq(%w[thebest taglist])