From 436c4fd972e1fa48c5f26d6963484301756c898a Mon Sep 17 00:00:00 2001
From: chrniedz <chrniedz@cisco.com>
Date: Fri, 6 Jan 2017 17:06:21 -0600
Subject: [PATCH] Fixed XSS from markdown()

---
 app/helpers/application_helper.rb | 2 +-
 spec/factories/events.rb          | 4 ++++
 spec/factories/lodgings.rb        | 4 ++++
 spec/factories/users.rb           | 5 +++++
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 6dcbd422..eae107cf 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -260,7 +260,7 @@ module ApplicationHelper
       space_after_headers: true,
       no_intra_emphasis: true
     }
-    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML, options)
+    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: true), options)
     markdown.render(text).html_safe
   end
 
diff --git a/spec/factories/events.rb b/spec/factories/events.rb
index c306cdf9..3012429d 100644
--- a/spec/factories/events.rb
+++ b/spec/factories/events.rb
@@ -35,4 +35,8 @@ FactoryGirl.define do
       end
     end
   end
+
+  factory :event_xss, parent: :event do
+    abstract { "<div id='divInjectedElement'></div>" }
+  end
 end
diff --git a/spec/factories/lodgings.rb b/spec/factories/lodgings.rb
index 636d9060..59f9fdb1 100644
--- a/spec/factories/lodgings.rb
+++ b/spec/factories/lodgings.rb
@@ -6,4 +6,8 @@ FactoryGirl.define do
     description { Faker::Lorem.paragraph }
     website_link { Faker::Internet.url }
   end
+
+  factory :lodging_xss, parent: :lodging do
+    description { "<div id='divInjectedElement'></div>" }
+  end
 end
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
index c7ed7ca1..824b4f9a 100644
--- a/spec/factories/users.rb
+++ b/spec/factories/users.rb
@@ -45,4 +45,9 @@ FactoryGirl.define do
       end
     end
   end
+
+  factory :user_xss, parent: :user do
+    biography "<div id='divInjectedElement'></div>"
+  end
+
 end