Correct use of Redcarpet’s safe_links_only flag

.rubocop_todo.yml

@@ -457,7 +457,7 @@ Metrics/MethodLength:
 # Offense count: 5
 # Configuration parameters: CountComments, CountAsOne.
 Metrics/ModuleLength:
-  Max: 173
+  Max: 174
 
 # Offense count: 26
 # Configuration parameters: IgnoredMethods.

app/helpers/format_helper.rb

@@ -190,15 +190,18 @@ module FormatHelper
   def markdown(text, escape_html=true)
     return '' if text.nil?
 
-    options = {
+    markdown_options = {
       autolink:                     true,
       space_after_headers:          true,
       no_intra_emphasis:            true,
       fenced_code_blocks:           true,
-      disable_indented_code_blocks: true,
+      disable_indented_code_blocks: true
-      safe_links_only:              true
     }
-    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: escape_html), options)
+    render_options = {
+      escape_html:     escape_html,
+      safe_links_only: true
+    }
+    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(render_options), markdown_options)
     sanitize(markdown.render(text))
   end
 

spec/helpers/format_helper_spec.rb

@@ -9,8 +9,8 @@ describe FormatHelper, type: :helper do
       expect(markdown(nil)).to eq ''
     end
 
-    it "doesn't render unsafe URI schemes" do
+    it "doesn't render links with unsafe URI schemes" do
-      expect(markdown('[a](javascript:b)')).to eq "<p><a>a</a></p>\n"
+      expect(markdown('[a](javascript:b)')).to eq "<p>[a](javascript:b)</p>\n"
     end
 
     it 'should return HTML for header markdown' do