Fix encoding of special characters on organization page rendering (#3944)

app/controllers/organizations_controller.rb

@@ -70,7 +70,7 @@ class OrganizationsController < ApplicationController
     params.require(:organization).permit(permitted_params).
       transform_values do |value|
         if value.class.name == "String"
-          Loofah.scrub_fragment(value, :prune).text(encode_special_chars: false)
+          ActionController::Base.helpers.strip_tags(value)
         else
           value
         end

app/views/articles/_user_metadata.html.erb

@@ -13,7 +13,7 @@
             headquarters
           </div>
           <div class="value">
-            <%= @organization.location %>
+            <%= sanitize @organization.location %>
           </div>
         </div>
       <% end %>
@@ -33,7 +33,7 @@
             support_email
           </div>
           <div class="value">
-            <a href="mailto:<%= @organization.email %>"><%= @organization.email %></a>
+            <a href="mailto:<%= sanitize @organization.email %>"><%= sanitize @organization.email %></a>
           </div>
         </div>
       <% end %>

app/views/organizations/show.html.erb

@@ -1,4 +1,4 @@
-<% title @organization.name %>
+<% title sanitize(@organization.name) %>
 
 <%= content_for :page_meta do %>
   <%= render "users/meta" %>

app/views/users/_profile_header.html.erb

@@ -18,13 +18,13 @@
     </div>
     <div class="profile-details">
       <h1 style="color:<%= HexComparer.new([user_colors(@user)[:bg], user_colors(@user)[:text]]).brightness(0.78) %>">
-        <span itemprop="name"><%= @user.name %></span>
+        <span itemprop="name"><%= sanitize @user.name %></span>
         <span class="user-profile-follow-button-wrapper">
           <button id="user-follow-butt" class="cta follow-action-button user-profile-follow-button" style="color:<%= user_colors(@user)[:text] %>;background-color:<%= user_colors(@user)[:bg] %>" data-info='{"id":<%= @user.id %>,"className":"<%= @user.class.name %>"}'>&nbsp;</button>
         </span>
       </h1>
       <p class="profile-description" itemprop="description">
-        <%= @user.summary.presence || ["404 bio not found"].sample %>
+        <%= sanitize(@user.summary.presence || "404 bio not found") %>
       </p>
       <style>
         .profile-details .social .icon-img path {

spec/requests/user_profile_spec.rb

@@ -61,6 +61,30 @@ RSpec.describe "UserProfiles", type: :request do
         get organization.path
         expect(response.body).to include "Gold Community Sponsor"
       end
+
+      it "renders organization name properly encoded" do
+        organization.update(name: "Org & < ' \" 1")
+        get organization.path
+        expect(response.body).to include(ActionController::Base.helpers.sanitize(organization.name))
+      end
+
+      it "renders organization email properly encoded" do
+        organization.update(email: "t&st&mail@dev.to")
+        get organization.path
+        expect(response.body).to include(ActionController::Base.helpers.sanitize(organization.email))
+      end
+
+      it "renders organization summary properly encoded" do
+        organization.update(summary: "Org & < ' \" &quot; 1")
+        get organization.path
+        expect(response.body).to include(ActionController::Base.helpers.sanitize(organization.summary))
+      end
+
+      it "renders organization location properly encoded" do
+        organization.update(location: "123, ave dev & < ' \" &quot; to")
+        get organization.path
+        expect(response.body).to include(ActionController::Base.helpers.sanitize(organization.location))
+      end
     end
 
     context "when github repo" do