diff --git a/.erb-lint.yml b/.erb-lint.yml index e6a3588a0..f05a282b4 100644 --- a/.erb-lint.yml +++ b/.erb-lint.yml @@ -23,6 +23,8 @@ linters: Enabled: false Layout/LineLength: Max: 289 + Exclude: + - '**/app/views/comments/_comment_proper.html.erb' Layout/TrailingEmptyLines: Enabled: false Lint/UselessAssignment: diff --git a/app/liquid_tags/liquid_tag_base.rb b/app/liquid_tags/liquid_tag_base.rb index 04fe5f4cb..5e1d97c45 100644 --- a/app/liquid_tags/liquid_tag_base.rb +++ b/app/liquid_tags/liquid_tag_base.rb @@ -1,6 +1,6 @@ class LiquidTagBase < Liquid::Tag def self.script - "" + "".html_safe end def finalize_html(input) diff --git a/app/liquid_tags/podcast_tag.rb b/app/liquid_tags/podcast_tag.rb index 48e02890a..2b1832a72 100644 --- a/app/liquid_tags/podcast_tag.rb +++ b/app/liquid_tags/podcast_tag.rb @@ -33,7 +33,7 @@ class PodcastTag < LiquidTagBase end def self.script - <<~JAVASCRIPT + "".html_safe + <<~JAVASCRIPT var waitingOnPodcast = setInterval(function(){ if (typeof initializePodcastPlayback !== 'undefined') { initializePodcastPlayback(); diff --git a/app/liquid_tags/tweet_tag.rb b/app/liquid_tags/tweet_tag.rb index 0596374ec..86da71d17 100644 --- a/app/liquid_tags/tweet_tag.rb +++ b/app/liquid_tags/tweet_tag.rb @@ -22,26 +22,27 @@ class TweetTag < LiquidTagBase end def self.script - 'var videoPreviews = document.getElementsByClassName("ltag__twitter-tweet__media__video-wrapper"); - [].forEach.call(videoPreviews, function(el){ - el.onclick= function(e){ - var divHeight = el.offsetHeight; - el.style.maxHeight = divHeight + "px"; - el.getElementsByClassName("ltag__twitter-tweet__media--video-preview")[0].style.display = "none"; - el.getElementsByClassName("ltag__twitter-tweet__video")[0].style.display = "block"; - el.getElementsByTagName("video")[0].play(); - } - }) - var tweets = document.getElementsByClassName("ltag__twitter-tweet__main"); - [].forEach.call(tweets, function(tweet){ - tweet.onclick= function(e){ - if (e.target.nodeName == "A" || e.target.parentElement.nodeName == "A"){ - return; + "".html_safe + + 'var videoPreviews = document.getElementsByClassName("ltag__twitter-tweet__media__video-wrapper"); + [].forEach.call(videoPreviews, function(el){ + el.onclick= function(e){ + var divHeight = el.offsetHeight; + el.style.maxHeight = divHeight + "px"; + el.getElementsByClassName("ltag__twitter-tweet__media--video-preview")[0].style.display = "none"; + el.getElementsByClassName("ltag__twitter-tweet__video")[0].style.display = "block"; + el.getElementsByTagName("video")[0].play(); } - window.open(tweet.dataset.url,"_blank"); - } - }); - ' + }) + var tweets = document.getElementsByClassName("ltag__twitter-tweet__main"); + [].forEach.call(tweets, function(tweet){ + tweet.onclick= function(e){ + if (e.target.nodeName == "A" || e.target.parentElement.nodeName == "A"){ + return; + } + window.open(tweet.dataset.url,"_blank"); + } + }); + ' end private diff --git a/app/models/comment.rb b/app/models/comment.rb index 310572dfc..e80db8bd9 100644 --- a/app/models/comment.rb +++ b/app/models/comment.rb @@ -181,6 +181,10 @@ class Comment < ApplicationRecord "comments-#{id}" end + def safe_processed_html + processed_html.html_safe + end + private def update_notifications diff --git a/app/views/comments/_comment_proper.html.erb b/app/views/comments/_comment_proper.html.erb index 1b4a18bc6..be3c35a05 100644 --- a/app/views/comments/_comment_proper.html.erb +++ b/app/views/comments/_comment_proper.html.erb @@ -78,7 +78,7 @@
"> - <%= comment.processed_html.html_safe %> + <%= comment.safe_processed_html %>
- <%= comment.processed_html.html_safe %> + <%= comment.safe_processed_html %>
diff --git a/app/views/comments/delete_confirm.html.erb b/app/views/comments/delete_confirm.html.erb index 89b85bfd2..80eb287a7 100644 --- a/app/views/comments/delete_confirm.html.erb +++ b/app/views/comments/delete_confirm.html.erb @@ -1,6 +1,6 @@
-

<%= truncate(strip_tags(@comment.processed_html.html_safe), length: 80) %>

+

<%= truncate(sanitize(@comment.processed_html, tags: []), length: 80) %>

Are you sure you want to delete this comment?

You cannot undo this action, perhaps you just want to EDIT instead?

diff --git a/app/views/comments/index.html.erb b/app/views/comments/index.html.erb index 73af0e039..9ad8d80a1 100644 --- a/app/views/comments/index.html.erb +++ b/app/views/comments/index.html.erb @@ -59,7 +59,7 @@
<% else %>
- <%= truncate(strip_tags(@commentable.processed_html), length: 150).html_safe %> + <%= truncate(sanitize(@commentable.processed_html, tags: []), length: 150) %> [Read Full]
<% end %> @@ -122,8 +122,8 @@ <% end %>