Sanitization

Author: fbacall

app/helpers/application_helper.rb

@@ -119,8 +119,9 @@ def flash_messages(_opts = {})
 
   def render_markdown(markdown_text, options = {}, renderer_options = {})
     if markdown_text
-      options.reverse_merge!(filter_html: true, tables: true, autolink: true)
-      renderer_options.reverse_merge!(hard_wrap: true, link_attributes: { target: '_blank', rel: 'noopener' })
+      default_opts = { filter_html: true, tables: true, autolink: true }
+      options.reverse_merge!(default_opts)
+      renderer_options.reverse_merge!(**default_opts, hard_wrap: true, link_attributes: { target: '_blank', rel: 'noopener' })
       Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(renderer_options), options).render(markdown_text).html_safe
     else
       ''

app/helpers/materials_helper.rb

@@ -109,15 +109,25 @@ def display_attribute(resource, attribute, show_label: true, title: nil, markdow
     ].any?
 
     value = resource.send(attribute)
-    value = render_markdown(value) if markdown
-    value = yield(value) if block_given? && value.present? && !list
+    if markdown
+      value = render_markdown(value)
+    end
+    if value.present?
+      if list
+        value = value.map do |v|
+          html_escape(block_given? ? yield(v) : v)
+        end
+      else
+        value = html_escape(block_given? ? yield(value) : value)
+      end
+    end
     string = "<p class=\"#{attribute}#{show_label ? ' no-spacing' : ''}\">"
     unless value.blank? || value.try(:strip) == 'License Not Specified'
       string << "<strong class='text-primary'> #{title || resource.class.human_attribute_name(attribute)}: </strong>" if show_label
       if list
         string << '<ul>'
         value.each do |v|
-          string << "<li>#{block_given? ? yield(v) : v}</li>"
+          string << "<li>#{v}</li>"
         end
         string << '</ul>'
       elsif expandable

app/views/layouts/_head.html.erb

@@ -28,7 +28,7 @@
   <% if @bioschemas.present? %>
     <% @bioschemas.each do |data| %>
       <script type="application/ld+json">
-        <%== data.to_json %>
+        <%== json_escape(data.to_json) %>
       </script>
     <% end %>
   <% end %>