Escape HTML in the notifications view (#3243)

app/views/notifications/_aggregated_reactions.html.erb

@@ -22,7 +22,7 @@
     reacted to
     <a href="<%= reactable_data["path"] %>" class="notification-comment-reacted-link">
       <%# your article/comment or the actual title of the article/comment %>
-      <%= reactable_data["title"].blank? ? "your #{reactable_data['class']['name'].downcase}" : sanitize(reactable_data["title"]) %>
+      <%= reactable_data["title"].blank? ? "your #{reactable_data['class']['name'].downcase}" : h(reactable_data["title"]) %>
     </a>
     <span class="reaction-images">
           with

app/views/notifications/_article.html.erb

@@ -40,7 +40,7 @@
       <a href="<%= json_data["article"]["path"] %>">
         <div class="notification-new-post">
           <div class="notification-new-post-title">
-            <%= sanitize(json_data["article"]["title"]) %>
+            <%= h(json_data["article"]["title"]) %>
           </div>
           <div class="notification-new-post-tags">
             <% json_data["article"]["cached_tag_list_array"].each do |tag| %>

app/views/notifications/_comment.html.erb

@@ -18,7 +18,7 @@
       commented on
       <% end %>
       <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-        <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+        <%= h(json_data["comment"]["commentable"]["title"]) %>
       </a>
       <div>
         <small><%= time_ago_in_words notification.notifiable.created_at %> ago</small>
@@ -30,7 +30,7 @@
       <br /><br>
       <b>Here's the article for context:
         <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-          <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+          <%= h(json_data["comment"]["commentable"]["title"]) %>
         </a></b>
       <%= render "notifications/shared/comment_box", json_data: json_data, notification: notification, context: "moderation" %>
       <br>
@@ -39,7 +39,7 @@
       <a href="<%= json_data["user"]["path"] %>"><%= json_data["user"]["name"] %></a>
       wrote their first comment on:
       <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-        <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+        <%= h(json_data["comment"]["commentable"]["title"]) %>
       </a>
       <div>
         <small><%= time_ago_in_words notification.created_at %> ago</small>

app/views/notifications/_milestone.html.erb

@@ -2,7 +2,7 @@
 <div class="content notification-content badge-content">
   <div class="badge-title">
     Your post
-    <a href="<%= json_data["article"]["path"] %>"><%= json_data["article"]["title"] %></a> passed <%= notification.milestone_count %> <%= notification.milestone_type.pluralize.downcase %>!
+    <a href="<%= json_data["article"]["path"] %>"><%= h(json_data["article"]["title"]) %></a> passed <%= notification.milestone_count %> <%= notification.milestone_type.pluralize.downcase %>!
   </div>
   <p class="badge-description milestone-emojis">🎉🎉🎉🎉🎉🎉🎉🎉</p>
 

app/views/notifications/_tagadjustment.html.erb

@@ -8,7 +8,7 @@
   <br /><br />
   Moderators removed the
   <b><a href="/t/<%= data["tag_name"] %>" style="font-weight: 900">#<%= data["tag_name"] %></a></b> tag from your post
-  <a href="<%= data["article"]["path"] %>"><%= data["article"]["title"] %></a>.
+  <a href="<%= data["article"]["path"] %>"><%= h(data["article"]["title"]) %></a>.
   <br /><br />
   Certain tags have special submission guidelines, and mods need to adjust tags to best fit the community.
   <br /><br />

spec/requests/notifications_spec.rb

@@ -131,14 +131,14 @@ RSpec.describe "NotificationsIndex", type: :request do
       it "properly renders reactable titles" do
         mock_heart_reaction_notifications(1, %w[unicorn like readinglist], special_characters_article)
         get "/notifications"
-        expect(response.body).to include special_characters_article.title
+        expect(response.body).to include ERB::Util.html_escape(special_characters_article.title)
       end
 
       it "properly renders reactable titles for multiple reactions" do
         amount = rand(3..10)
         mock_heart_reaction_notifications(amount, %w[unicorn like readinglist], special_characters_article)
         get "/notifications"
-        expect(response.body).to include special_characters_article.title
+        expect(response.body).to include ERB::Util.html_escape(special_characters_article.title)
       end
     end