From a052b16015c228556f723422face7bfa0e78b0a9 Mon Sep 17 00:00:00 2001 From: Daniel Uber Date: Tue, 22 Feb 2022 11:27:38 -0600 Subject: [PATCH] Don't sanitize anchor elements with no href (#16667) * If href is nil, allow node * Add unit test showing no change My first pass had the `` within an h1 content, but the scrubber added a newline after the closing a tag? --- app/sanitizers/feed_markdown_scrubber.rb | 2 +- spec/sanitizers/feed_markdown_scrubber_spec.rb | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/app/sanitizers/feed_markdown_scrubber.rb b/app/sanitizers/feed_markdown_scrubber.rb index e006564e8..29682cb90 100644 --- a/app/sanitizers/feed_markdown_scrubber.rb +++ b/app/sanitizers/feed_markdown_scrubber.rb @@ -8,6 +8,6 @@ class FeedMarkdownScrubber < Rails::Html::PermitScrubber def allowed_node?(node) return true if tags.include?(node.name) && node.name != "a" - node.name == "a" && !node["href"].start_with?("#") + node.name == "a" && !node["href"]&.start_with?("#") end end diff --git a/spec/sanitizers/feed_markdown_scrubber_spec.rb b/spec/sanitizers/feed_markdown_scrubber_spec.rb index 7f3f34da3..685a016dd 100644 --- a/spec/sanitizers/feed_markdown_scrubber_spec.rb +++ b/spec/sanitizers/feed_markdown_scrubber_spec.rb @@ -57,4 +57,10 @@ RSpec.describe FeedMarkdownScrubber, type: :permit_scrubber do clean = sanitize(bad_html, scrubber: described_class.new) expect(clean).to eq(good_html) end + + it "does not scrub anchors with no link" do + good_html = "I put an anchor here" + clean = sanitize(good_html, scrubber: described_class.new) + expect(clean).to eq(good_html) + end end