Merge pull request #32514 from code-dot-org/render_multi_or_match_con…

…tent-use-content-tag Use content_tag rather than string interpolation to safely build HTML element
code-dot-org · Dec 20, 2019 · 8ea6ee6 · 8ea6ee6
2 parents 488427b + 0ed9c43
commit 8ea6ee6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/dashboard/app/helpers/levels_helper.rb b/dashboard/app/helpers/levels_helper.rb
@@ -606,7 +606,9 @@ def build_copyright_strings
   end
 
   def match_answer_as_image(path, width)
-    "<img src='#{path.strip}' #{"width='#{width.strip}'" if width}></img>"
+    attrs = {src: path.strip}
+    attrs[:width] = width.strip if width
+    content_tag(:img, '', attrs)
   end
 
   def match_answer_as_embedded_blockly(path)

diff --git a/dashboard/test/helpers/levels_helper_test.rb b/dashboard/test/helpers/levels_helper_test.rb
@@ -713,7 +713,7 @@ def stub_country(code)
   end
 
   test 'render_multi_or_match_content can generate images' do
-    assert_equal render_multi_or_match_content("example.png"), "<img src='example.png' ></img>"
+    assert_equal render_multi_or_match_content("example.png"), "<img src=\"example.png\"></img>"
   end
 
   test 'render_multi_or_match_content can generate embedded blockly' do