gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed XSS from markdown()

Browse source
This commit is contained in:
chrniedz 2017-01-06 17:06:21 -06:00
parent a42240b5a6
commit 436c4fd972
4 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/helpers/application_helper.rb
View file

@ -260,7 +260,7 @@ module ApplicationHelper
space_after_headers: true,
no_intra_emphasis: true
}
markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML, options)
markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: true), options)
markdown.render(text).html_safe
end