diff --git a/app/services/shared_markers.rb b/app/services/shared_markers.rb index e127d43d..6d5bf990 100644 --- a/app/services/shared_markers.rb +++ b/app/services/shared_markers.rb @@ -19,7 +19,8 @@ module SharedMarkers }) end - content_tag(:a, text.nil? ? link : text, options) + # Marking the text content as HTML safe as content_tag already escapes it for us + content_tag(:a, text.nil? ? link : text.html_safe, options) rescue link end diff --git a/spec/helpers/markdown_helper_spec.rb b/spec/helpers/markdown_helper_spec.rb index ba9d7514..4328501e 100644 --- a/spec/helpers/markdown_helper_spec.rb +++ b/spec/helpers/markdown_helper_spec.rb @@ -22,6 +22,15 @@ describe MarkdownHelper, type: :helper do it "should transform mentions into links" do expect(markdown("@jake_weary")).to eq('
') end + + it "should escape text in links" do + expect(markdown("[It's a link](https://example.com)")).to eq('') + expect(markdown("[It's >a link](https://example.com)")).to eq('') + end + + it "should escape HTML tags" do + expect(markdown("I'mI'm <h1>a test</h1>
") + end end describe "#strip_markdown" do