From e486ce55d75286c5c5bca47eda76a6e506d38efb Mon Sep 17 00:00:00 2001
From: Andrew Kvalheim <Andrew@Kvalhe.im>
Date: Thu, 17 Mar 2022 16:13:47 -0700
Subject: [PATCH 1/3] Remove test of implementation details

---
 spec/helpers/format_helper_spec.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/spec/helpers/format_helper_spec.rb b/spec/helpers/format_helper_spec.rb
index dc364c2c..21198ffa 100644
--- a/spec/helpers/format_helper_spec.rb
+++ b/spec/helpers/format_helper_spec.rb
@@ -10,10 +10,6 @@ describe FormatHelper, type: :helper do
     end
 
     it 'should return HTML for header markdown' do
-      expect(Redcarpet::Markdown).to receive(:new)
-      .with(Redcarpet::Render::HTML, autolink: true, space_after_headers: true, no_intra_emphasis: true, fenced_code_blocks: true, disable_indented_code_blocks: true, safe_links_only: true)
-      .and_call_original
-
       expect(markdown('# this is my header')).to eq "<h1>this is my header</h1>\n"
     end
   end

From a281110b2908f55b6750c6ad72374c12b35dea15 Mon Sep 17 00:00:00 2001
From: Andrew Kvalheim <Andrew@Kvalhe.im>
Date: Thu, 17 Mar 2022 16:44:27 -0700
Subject: [PATCH 2/3] Add test of markdown link protocol sanitization

---
 spec/helpers/format_helper_spec.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spec/helpers/format_helper_spec.rb b/spec/helpers/format_helper_spec.rb
index 21198ffa..288d8441 100644
--- a/spec/helpers/format_helper_spec.rb
+++ b/spec/helpers/format_helper_spec.rb
@@ -9,6 +9,10 @@ describe FormatHelper, type: :helper do
       expect(markdown(nil)).to eq ''
     end
 
+    it "doesn't render unsafe URI schemes" do
+      expect(markdown('[a](javascript:b)')).to eq "<p><a>a</a></p>\n"
+    end
+
     it 'should return HTML for header markdown' do
       expect(markdown('# this is my header')).to eq "<h1>this is my header</h1>\n"
     end

From 685d79e44b29e5f0cf9d0d28fc48f6f407a291c5 Mon Sep 17 00:00:00 2001
From: Andrew Kvalheim <Andrew@Kvalhe.im>
Date: Thu, 17 Mar 2022 16:47:47 -0700
Subject: [PATCH 3/3] =?UTF-8?q?Correct=20use=20of=20Redcarpet=E2=80=99s=20?=
 =?UTF-8?q?`safe=5Flinks=5Fonly`=20flag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .rubocop_todo.yml                  |  2 +-
 app/helpers/format_helper.rb       | 11 +++++++----
 spec/helpers/format_helper_spec.rb |  4 ++--
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 0d9a6f13..db214cb7 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -457,7 +457,7 @@ Metrics/MethodLength:
 # Offense count: 5
 # Configuration parameters: CountComments, CountAsOne.
 Metrics/ModuleLength:
-  Max: 173
+  Max: 174
 
 # Offense count: 26
 # Configuration parameters: IgnoredMethods.
diff --git a/app/helpers/format_helper.rb b/app/helpers/format_helper.rb
index 67f53b2c..07a982ab 100644
--- a/app/helpers/format_helper.rb
+++ b/app/helpers/format_helper.rb
@@ -190,15 +190,18 @@ module FormatHelper
   def markdown(text, escape_html=true)
     return '' if text.nil?
 
-    options = {
+    markdown_options = {
       autolink:                     true,
       space_after_headers:          true,
       no_intra_emphasis:            true,
       fenced_code_blocks:           true,
-      disable_indented_code_blocks: true,
-      safe_links_only:              true
+      disable_indented_code_blocks: true
     }
-    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: escape_html), options)
+    render_options = {
+      escape_html:     escape_html,
+      safe_links_only: true
+    }
+    markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(render_options), markdown_options)
     sanitize(markdown.render(text))
   end
 
diff --git a/spec/helpers/format_helper_spec.rb b/spec/helpers/format_helper_spec.rb
index 288d8441..4e64eb94 100644
--- a/spec/helpers/format_helper_spec.rb
+++ b/spec/helpers/format_helper_spec.rb
@@ -9,8 +9,8 @@ describe FormatHelper, type: :helper do
       expect(markdown(nil)).to eq ''
     end
 
-    it "doesn't render unsafe URI schemes" do
-      expect(markdown('[a](javascript:b)')).to eq "<p><a>a</a></p>\n"
+    it "doesn't render links with unsafe URI schemes" do
+      expect(markdown('[a](javascript:b)')).to eq "<p>[a](javascript:b)</p>\n"
     end
 
     it 'should return HTML for header markdown' do