Fix an XSS attack on the board

linuxfrorg · Apr 28, 2011 · e03e2da · e03e2da
1 parent e1cd800
commit e03e2da
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/app/models/board.rb b/app/models/board.rb
@@ -79,13 +79,14 @@ def rendered
 
   include ActionView::Helpers::TagHelper
   include ActionView::Helpers::TextHelper
+  include ActionView::Helpers::SanitizeHelper
 
   def sanitize_message
     doc = Nokogiri::HTML::Document.new
     doc.encoding = "utf-8"
     node = Nokogiri::HTML::DocumentFragment.new(doc)
     inner_sanitize(node, @message[0, 500])
-    @message = auto_link(node.to_s, :urls) { "[url]" }.html_safe
+    @message = sanitize(auto_link(node.to_s, :urls) { "[url]" })
   end
 
   def inner_sanitize(parent, str)