Refactor preview_card partial to avoid brakeman XSS warning

mastodon · Oct 17, 2023 · d67fb5c · d67fb5c
1 parent 0036de4
commit d67fb5c
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 34 deletions.
diff --git a/app/helpers/formatting_helper.rb b/app/helpers/formatting_helper.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module FormattingHelper
+  include ERB::Util
+
   def html_aware_format(text, local, options = {})
     HtmlAwareFormatter.new(text, local, options).to_s
   end
@@ -9,6 +11,10 @@ def linkify(text, options = {})
     TextFormatter.new(text, options).to_s
   end
 
+  def encode_url(url)
+    url_encode(url)
+  end
+
   def extract_status_plain_text(status)
     PlainTextFormatter.new(status.text, status.local?).to_s
   end

diff --git a/app/views/admin/trends/links/_preview_card.html.haml b/app/views/admin/trends/links/_preview_card.html.haml
@@ -4,7 +4,7 @@
 
   .batch-table__row__content.pending-account
     .pending-account__header
-      = link_to preview_card.title, preview_card.url
+      = link_to preview_card.title, encode_url(preview_card.url)
 
       %br/
 

diff --git a/config/brakeman.ignore b/config/brakeman.ignore
@@ -32,39 +32,6 @@
         79
       ],
       "note": ""
-    },
-    {
-      "warning_type": "Cross-Site Scripting",
-      "warning_code": 4,
-      "fingerprint": "cd5cfd7f40037fbfa753e494d7129df16e358bfc43ef0da3febafbf4ee1ed3ac",
-      "check_name": "LinkToHref",
-      "message": "Potentially unsafe model attribute in `link_to` href",
-      "file": "app/views/admin/trends/links/_preview_card.html.haml",
-      "line": 7,
-      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
-      "code": "link_to((Unresolved Model).new.title, (Unresolved Model).new.url)",
-      "render_path": [
-        {
-          "type": "template",
-          "name": "admin/trends/links/index",
-          "line": 49,
-          "file": "app/views/admin/trends/links/index.html.haml",
-          "rendered": {
-            "name": "admin/trends/links/_preview_card",
-            "file": "app/views/admin/trends/links/_preview_card.html.haml"
-          }
-        }
-      ],
-      "location": {
-        "type": "template",
-        "template": "admin/trends/links/_preview_card"
-      },
-      "user_input": "(Unresolved Model).new.url",
-      "confidence": "Weak",
-      "cwe_id": [
-        79
-      ],
-      "note": ""
     }
   ],
   "updated": "2023-07-12 11:20:51 -0400",