Fixed XSS from markdown()

app/helpers/application_helper.rb

@@ -260,7 +260,7 @@ module ApplicationHelper
       space_after_headers: true,
       no_intra_emphasis: true
     }
-    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML, options)
+    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: true), options)
     markdown.render(text).html_safe
   end
 

spec/factories/events.rb

@@ -35,4 +35,8 @@ FactoryGirl.define do
       end
     end
   end
+
+  factory :event_xss, parent: :event do
+    abstract { "<div id='divInjectedElement'></div>" }
+  end
 end

spec/factories/lodgings.rb

@@ -6,4 +6,8 @@ FactoryGirl.define do
     description { Faker::Lorem.paragraph }
     website_link { Faker::Internet.url }
   end
+
+  factory :lodging_xss, parent: :lodging do
+    description { "<div id='divInjectedElement'></div>" }
+  end
 end

spec/factories/users.rb

@@ -45,4 +45,9 @@ FactoryGirl.define do
       end
     end
   end
+
+  factory :user_xss, parent: :user do
+    biography "<div id='divInjectedElement'></div>"
+  end
+
 end