Make linkify return an HTML safe result for unsafe inputs

Fixes #2567

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 0f2c862e6b60a212a21b541c7b76a6c921141cbe..79c6e6134a007843d0ca5e2b04d1138855dc47f6 100644 (file)
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -5,7 +5,7 @@ module ApplicationHelper
     if text.html_safe?
       Rinku.auto_link(text, :urls, tag_builder.tag_options(:rel => "nofollow")).html_safe
     else
-      Rinku.auto_link(text, :urls, tag_builder.tag_options(:rel => "nofollow"))
+      Rinku.auto_link(ERB::Util.h(text), :urls, tag_builder.tag_options(:rel => "nofollow")).html_safe
     end
   end
 

diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb
index 16b1040e522e99eebe659033f3ed10db6e093f1c..dc45a6c07bce919a59bb880e41be58f37b5a73d9 100644 (file)
--- a/test/helpers/application_helper_test.rb
+++ b/test/helpers/application_helper_test.rb
@@ -13,27 +13,27 @@ class ApplicationHelperTest < ActionView::TestCase
 
   def test_linkify
     %w[http://example.com/test ftp://example.com/test https://example.com/test].each do |link|
-      text = "Test #{link} is made into a link"
+      text = "Test #{link} is <b>made</b> into a link"
 
       html = linkify(text)
-      assert_equal false, html.html_safe?
-      assert_dom_equal "Test <a href=\"#{link}\" rel=\"nofollow\">#{link}</a> is made into a link", html
+      assert_equal true, html.html_safe?
+      assert_dom_equal "Test <a href=\"#{link}\" rel=\"nofollow\">#{link}</a> is &lt;b&gt;made&lt;/b&gt; into a link", html
 
       html = linkify(text.html_safe)
       assert_equal true, html.html_safe?
-      assert_dom_equal "Test <a href=\"#{link}\" rel=\"nofollow\">#{link}</a> is made into a link", html
+      assert_dom_equal "Test <a href=\"#{link}\" rel=\"nofollow\">#{link}</a> is <b>made</b> into a link", html
     end
 
     %w[test@example.com mailto:test@example.com].each do |link|
-      text = "Test #{link} is not made into a link"
+      text = "Test #{link} is not <b>made</b> into a link"
 
       html = linkify(text)
-      assert_equal false, html.html_safe?
-      assert_dom_equal text, html
+      assert_equal true, html.html_safe?
+      assert_dom_equal "Test #{link} is not &lt;b&gt;made&lt;/b&gt; into a link", html
 
       html = linkify(text.html_safe)
       assert_equal true, html.html_safe?
-      assert_dom_equal text, html
+      assert_dom_equal "Test #{link} is not <b>made</b> into a link", html
     end
   end