diff --git a/spec/presenters/address_presenter_spec.rb b/spec/presenters/address_presenter_spec.rb index 67a08fe69..591c3b1a1 100644 --- a/spec/presenters/address_presenter_spec.rb +++ b/spec/presenters/address_presenter_spec.rb @@ -12,8 +12,9 @@ it 'escapes HTML in address elements' do address.street = '' - html_address = "#{address.flat}
<script>alert("XSS");</script>
" + - "#{address.city}, #{address.postal_code}" + escape = ERB::Util.method(:html_escape) + html_address = "#{escape.call(address.flat)}
<script>alert("XSS");</script>
" + + "#{escape.call(address.city)}, #{escape.call(address.postal_code)}" expect(presenter.to_html).to eq(html_address) end