diff --git a/app/helpers/markdown_helper.rb b/app/helpers/markdown_helper.rb index 23af88a1..6d80f255 100644 --- a/app/helpers/markdown_helper.rb +++ b/app/helpers/markdown_helper.rb @@ -7,12 +7,12 @@ module MarkdownHelper def strip_markdown(content) md = Redcarpet::Markdown.new(Redcarpet::Render::StripDown, MARKDOWN_OPTS) - CGI.unescape_html(Sanitize.fragment(md.render(content), EVIL_TAGS)).strip + CGI.unescape_html(Sanitize.fragment(CGI.escape_html(md.render(content)), EVIL_TAGS)).strip end def twitter_markdown(content) md = Redcarpet::Markdown.new(TwitteredMarkdown, MARKDOWN_OPTS) - CGI.unescape_html(Sanitize.fragment(md.render(content), EVIL_TAGS)).strip + CGI.unescape_html(Sanitize.fragment(CGI.escape_html(md.render(content)), EVIL_TAGS)).strip end def question_markdown(content) diff --git a/spec/helpers/markdown_helper_spec.rb b/spec/helpers/markdown_helper_spec.rb index bcfdecf1..b5ecf606 100644 --- a/spec/helpers/markdown_helper_spec.rb +++ b/spec/helpers/markdown_helper_spec.rb @@ -59,6 +59,10 @@ describe MarkdownHelper, type: :helper do expect(twitter_markdown("@test")).to eq("test") end end + + it "should not strip weird hearts" do + expect(twitter_markdown("