Remove escaping of user_params (#500)

* Remove the need to escape user_params

* Fix lint

* Permit password and password_confirmation

* Fix lint

app/controllers/users_controller.rb

@@ -21,7 +21,7 @@ class UsersController < ApplicationController
     @tab_list = @user.settings_tab_list
     @tab = params["user"]["tab"] || "profile"
     authorize @user
-    if @user.update(user_params)
+    if @user.update(permitted_attributes(@user))
       RssReader.new.delay.fetch_user(@user) if @user.feed_url.present?
       notice = "Your profile was successfully updated."
       follow_hiring_tag(@user)
@@ -116,58 +116,4 @@ class UsersController < ApplicationController
       end
     end
   end
-
-  private
-
-  def user_params
-    accessible = %i[name
-                    email
-                    username
-                    profile_image
-                    website_url
-                    summary
-                    email_newsletter
-                    email_digest_periodic
-                    email_membership_newsletter
-                    email_comment_notifications
-                    email_mention_notifications
-                    email_follower_notifications
-                    email_badge_notifications
-                    email_unread_notifications
-                    bg_color_hex
-                    text_color_hex
-                    employer_name
-                    employer_url
-                    employment_title
-                    currently_learning
-                    available_for
-                    mostly_work_with
-                    currently_hacking_on
-                    location
-                    email_public
-                    education
-                    looking_for_work
-                    looking_for_work_publicly
-                    contact_consent
-                    feed_url
-                    feed_mark_canonical
-                    prefer_language_en
-                    prefer_language_ja
-                    prefer_language_es
-                    prefer_language_fr
-                    prefer_language_it
-                    display_sponsors
-                    permit_adjacent_sponsors
-                    feed_admin_publish_permission]
-    accessible << %i[password password_confirmation] unless params[:user][:password].blank?
-    params.require(:user).
-      permit(accessible).
-      transform_values do |value|
-        if value.class.name == "String"
-          ActionController::Base.helpers.strip_tags(value)
-        else
-          value
-        end
-      end
-  end
 end

app/models/user.rb

@@ -1,6 +1,6 @@
-include CloudinaryHelper
-
 class User < ApplicationRecord
+  include CloudinaryHelper
+
   attr_accessor :scholar_email
   rolify
   include AlgoliaSearch
@@ -56,15 +56,15 @@ class User < ApplicationRecord
   validates :employer_url, url: { allow_blank: true, no_local: true, schemes: ["https", "http"] }
   validates :shirt_gender,
               inclusion: { in: %w(unisex womens),
-              message: "%{value} is not a valid shirt style" },
+                           message: "%{value} is not a valid shirt style" },
               allow_blank: true
   validates :shirt_size,
               inclusion: { in: %w(xs s m l xl 2xl 3xl 4xl),
-              message: "%{value} is not a valid size" },
+                           message: "%{value} is not a valid size" },
               allow_blank: true
   validates :tabs_or_spaces,
               inclusion: { in: %w(tabs spaces),
-              message: "%{value} is not a valid answer" },
+                           message: "%{value} is not a valid answer" },
               allow_blank: true
   validates :shipping_country,
               length: { in: 2..2 },
@@ -87,7 +87,6 @@ class User < ApplicationRecord
   before_validation :set_username
   before_validation :downcase_email
   before_validation :check_for_username_change
-  before_validation :unescape_summary
 
   algoliasearch per_environment: true, enqueue: :trigger_delayed_index do
     attribute :name
@@ -129,7 +128,7 @@ class User < ApplicationRecord
 
   def self.trigger_delayed_index(record, remove)
     if remove
-      record.delay.remove_from_index! if (record && record.persisted?)
+      record.delay.remove_from_index! if record&.persisted?
     else
       record.delay.index!
     end
@@ -146,28 +145,29 @@ class User < ApplicationRecord
   def estimate_default_language!
     identity = identities.where(provider: "twitter").first
     if email.end_with?(".jp")
-      self.update(:estimated_default_language => "ja", :prefer_language_ja => true)
+      update(estimated_default_language: "ja", prefer_language_ja: true)
     elsif identity
       lang = identity.auth_data_dump["extra"]["raw_info"]["lang"]
-      self.update(:estimated_default_language => lang, "prefer_language_#{lang}" => true)
+      update(:estimated_default_language => lang,
+             "prefer_language_#{lang}" => true)
     end
   end
   handle_asynchronously :estimate_default_language!
 
   def calculate_score
-    score = (articles.where(featured:true).size*100) + (comments.sum(:score))
-    self.update_column(:score, score)
+    score = (articles.where(featured: true).size * 100) + comments.sum(:score)
+    update_column(:score, score)
   end
 
   def path
-    "/"+username.to_s
+    "/" + username.to_s
   end
 
   def followed_articles
     Article.tagged_with(cached_followed_tag_names, any: true).union(
       Article.where(
         user_id: cached_following_users_ids,
-      )
+      ),
     ).where(language: cached_preferred_langs, published: true)
   end
 
@@ -203,8 +203,14 @@ class User < ApplicationRecord
   end
 
   def cached_followed_tag_names
-    Rails.cache.fetch("user-#{id}-#{updated_at}/followed_tag_names", expires_in: 100.hours) do
-      Tag.where(id:Follow.where(follower_id:id,followable_type:"ActsAsTaggableOn::Tag").pluck(:followable_id)).pluck(:name)
+    cache_name = "user-#{id}-#{updated_at}/followed_tag_names"
+    Rails.cache.fetch(cache_name, expires_in: 100.hours) do
+      Tag.where(
+        id: Follow.where(
+          follower_id: id,
+          followable_type: "ActsAsTaggableOn::Tag",
+        ).pluck(:followable_id),
+      ).pluck(:name)
     end
   end
 
@@ -300,15 +306,8 @@ class User < ApplicationRecord
     tab_list
   end
 
-
-
   private
 
-  def unescape_summary
-    return unless summary.present?
-    self.summary = CGI.unescapeHTML(summary)
-  end
-
   def send_welcome_notification
     Broadcast.send_welcome_notification(id)
   end
@@ -322,9 +321,9 @@ class User < ApplicationRecord
 
   def set_temp_username
     self.username = if temp_name_exists?
-      temp_username + "_" + rand(100).to_s
-    else
-      temp_username
+                      temp_username + "_" + rand(100).to_s
+                    else
+                      temp_username
     end
   end
 
@@ -335,7 +334,7 @@ class User < ApplicationRecord
   def temp_username
     if twitter_username
       twitter_username.downcase.gsub(/[^0-9a-z_]/i, "").gsub(/ /, "")
-    elsif  github_username
+    elsif github_username
       github_username.downcase.gsub(/[^0-9a-z_]/i, "").gsub(/ /, "")
     end
   end

app/policies/user_policy.rb

@@ -39,6 +39,50 @@ class UserPolicy < ApplicationPolicy
     user.has_role?(:trusted) && !user.banned
   end
 
+  def permitted_attributes
+    %i[available_for
+       bg_color_hex
+       contact_consent
+       currently_hacking_on
+       currently_learning
+       display_sponsors
+       education
+       email
+       email_badge_notifications
+       email_comment_notifications
+       email_digest_periodic
+       email_follower_notifications
+       email_membership_newsletter
+       email_mention_notifications
+       email_newsletter
+       email_public
+       email_unread_notifications
+       employer_name
+       employer_url
+       employment_title
+       feed_admin_publish_permission
+       feed_mark_canonical
+       feed_url
+       location
+       looking_for_work
+       looking_for_work_publicly
+       mostly_work_with
+       name
+       permit_adjacent_sponsors
+       password
+       password_confirmation
+       prefer_language_en
+       prefer_language_es
+       prefer_language_fr
+       prefer_language_it
+       prefer_language_ja
+       profile_image
+       summary
+       text_color_hex
+       username
+       website_url]
+  end
+
   private
 
   def within_the_same_org?