From bb6fe4495a4e3c8d6e15d529d19330d42310c5d6 Mon Sep 17 00:00:00 2001
From: Mazen Touati <14861869+mazentouati@users.noreply.github.com>
Date: Tue, 30 Jul 2019 19:24:23 +0100
Subject: [PATCH] Escape HTML in the notifications view (#3243)

---
 app/views/notifications/_aggregated_reactions.html.erb | 2 +-
 app/views/notifications/_article.html.erb              | 2 +-
 app/views/notifications/_comment.html.erb              | 6 +++---
 app/views/notifications/_milestone.html.erb            | 2 +-
 app/views/notifications/_tagadjustment.html.erb        | 2 +-
 spec/requests/notifications_spec.rb                    | 4 ++--
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/app/views/notifications/_aggregated_reactions.html.erb b/app/views/notifications/_aggregated_reactions.html.erb
index 856886874..88eab5c74 100644
--- a/app/views/notifications/_aggregated_reactions.html.erb
+++ b/app/views/notifications/_aggregated_reactions.html.erb
@@ -22,7 +22,7 @@
     reacted to
     <a href="<%= reactable_data["path"] %>" class="notification-comment-reacted-link">
       <%# your article/comment or the actual title of the article/comment %>
-      <%= reactable_data["title"].blank? ? "your #{reactable_data['class']['name'].downcase}" : sanitize(reactable_data["title"]) %>
+      <%= reactable_data["title"].blank? ? "your #{reactable_data['class']['name'].downcase}" : h(reactable_data["title"]) %>
     </a>
     <span class="reaction-images">
           with
diff --git a/app/views/notifications/_article.html.erb b/app/views/notifications/_article.html.erb
index f530adabc..c1ee79e68 100644
--- a/app/views/notifications/_article.html.erb
+++ b/app/views/notifications/_article.html.erb
@@ -40,7 +40,7 @@
       <a href="<%= json_data["article"]["path"] %>">
         <div class="notification-new-post">
           <div class="notification-new-post-title">
-            <%= sanitize(json_data["article"]["title"]) %>
+            <%= h(json_data["article"]["title"]) %>
           </div>
           <div class="notification-new-post-tags">
             <% json_data["article"]["cached_tag_list_array"].each do |tag| %>
diff --git a/app/views/notifications/_comment.html.erb b/app/views/notifications/_comment.html.erb
index 2aae7d826..f72bb6494 100644
--- a/app/views/notifications/_comment.html.erb
+++ b/app/views/notifications/_comment.html.erb
@@ -18,7 +18,7 @@
       commented on
       <% end %>
       <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-        <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+        <%= h(json_data["comment"]["commentable"]["title"]) %>
       </a>
       <div>
         <small><%= time_ago_in_words notification.notifiable.created_at %> ago</small>
@@ -30,7 +30,7 @@
       <br /><br>
       <b>Here's the article for context:
         <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-          <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+          <%= h(json_data["comment"]["commentable"]["title"]) %>
         </a></b>
       <%= render "notifications/shared/comment_box", json_data: json_data, notification: notification, context: "moderation" %>
       <br>
@@ -39,7 +39,7 @@
       <a href="<%= json_data["user"]["path"] %>"><%= json_data["user"]["name"] %></a>
       wrote their first comment on:
       <a href="<%= json_data["comment"]["commentable"]["path"] %>">
-        <%= sanitize(json_data["comment"]["commentable"]["title"]) %>
+        <%= h(json_data["comment"]["commentable"]["title"]) %>
       </a>
       <div>
         <small><%= time_ago_in_words notification.created_at %> ago</small>
diff --git a/app/views/notifications/_milestone.html.erb b/app/views/notifications/_milestone.html.erb
index 8660e2ac8..f8d339f00 100644
--- a/app/views/notifications/_milestone.html.erb
+++ b/app/views/notifications/_milestone.html.erb
@@ -2,7 +2,7 @@
 <div class="content notification-content badge-content">
   <div class="badge-title">
     Your post
-    <a href="<%= json_data["article"]["path"] %>"><%= json_data["article"]["title"] %></a> passed <%= notification.milestone_count %> <%= notification.milestone_type.pluralize.downcase %>!
+    <a href="<%= json_data["article"]["path"] %>"><%= h(json_data["article"]["title"]) %></a> passed <%= notification.milestone_count %> <%= notification.milestone_type.pluralize.downcase %>!
   </div>
   <p class="badge-description milestone-emojis">🎉🎉🎉🎉🎉🎉🎉🎉</p>
 
diff --git a/app/views/notifications/_tagadjustment.html.erb b/app/views/notifications/_tagadjustment.html.erb
index 0a42957fd..bd6b924ad 100644
--- a/app/views/notifications/_tagadjustment.html.erb
+++ b/app/views/notifications/_tagadjustment.html.erb
@@ -8,7 +8,7 @@
   <br /><br />
   Moderators removed the
   <b><a href="/t/<%= data["tag_name"] %>" style="font-weight: 900">#<%= data["tag_name"] %></a></b> tag from your post
-  <a href="<%= data["article"]["path"] %>"><%= data["article"]["title"] %></a>.
+  <a href="<%= data["article"]["path"] %>"><%= h(data["article"]["title"]) %></a>.
   <br /><br />
   Certain tags have special submission guidelines, and mods need to adjust tags to best fit the community.
   <br /><br />
diff --git a/spec/requests/notifications_spec.rb b/spec/requests/notifications_spec.rb
index f18f8e10e..c951a4291 100644
--- a/spec/requests/notifications_spec.rb
+++ b/spec/requests/notifications_spec.rb
@@ -131,14 +131,14 @@ RSpec.describe "NotificationsIndex", type: :request do
       it "properly renders reactable titles" do
         mock_heart_reaction_notifications(1, %w[unicorn like readinglist], special_characters_article)
         get "/notifications"
-        expect(response.body).to include special_characters_article.title
+        expect(response.body).to include ERB::Util.html_escape(special_characters_article.title)
       end
 
       it "properly renders reactable titles for multiple reactions" do
         amount = rand(3..10)
         mock_heart_reaction_notifications(amount, %w[unicorn like readinglist], special_characters_article)
         get "/notifications"
-        expect(response.body).to include special_characters_article.title
+        expect(response.body).to include ERB::Util.html_escape(special_characters_article.title)
       end
     end