[ci][webui] Fix presentation of package file names in webui

We have a package helper that replaces whitespaces in package names with nbsp. We
also add wbr tags to long file names. With recent OBS html sanitization this broke.
This commit fixes it.

src/api/app/helpers/webui/package_helper.rb

@@ -54,7 +54,19 @@ def package_bread_crumb( *args )
   end
 
   def nbsp(text)
-    return text.gsub(' ', ' ')
-  end
+    result = "".html_safe
+    text.split(" ").each do |text_chunk|
+      result << text_chunk
+      result << "&nbsp;".html_safe
+    end
+    result.chomp!("&nbsp;")
 
+    if result.length >= 50
+      # Allow break line for very long file names
+      result = result.scan(/.{1,50}/).join("<wbr>")
+    end
+    # We just need to make it a SafeBuffer object again, after calling chomp and join.
+    # But at this point we know it truly is html safe
+    result.html_safe
+  end
 end

src/api/app/views/webui/package/_files_view.html.erb

@@ -16,7 +16,7 @@
                  unless @is_current_rev
                    link_opts[:rev] = file[:srcmd5]
                  end %>
-              <%= link_to_if(file[:viewable], nbsp(file[:name]).scan(/.{1,50}/).join("<wbr>"), link_opts) %>
+              <%= link_to_if(file[:viewable], nbsp(file[:name]), link_opts) %>
             </td>
             <td><span class="hidden"><%= file[:size].rjust(10, '0') %></span><%= human_readable_fsize(file[:size]) %>
             </td>

src/api/test/unit/webui/package_helper_test.rb

@@ -0,0 +1,22 @@
+require 'test_helper'
+
+class Webui::PackageHelperTest < ActiveSupport::TestCase
+  include Webui::PackageHelper
+
+  def test_nbsp
+    assert nbsp("a").is_a?(ActiveSupport::SafeBuffer)
+
+    sanitized_string = nbsp("<b>unsafe<b/>")
+    assert_equal "&lt;b&gt;unsafe&lt;b/&gt;", sanitized_string
+    assert sanitized_string.is_a?(ActiveSupport::SafeBuffer)
+
+    sanitized_string = nbsp("my file")
+    assert_equal "my&nbsp;file", sanitized_string
+    assert sanitized_string.is_a?(ActiveSupport::SafeBuffer)
+
+    long_file_name = "a"*50 + "b"*50 + "c"*10
+    sanitized_string = nbsp(long_file_name)
+    assert_equal long_file_name.scan(/.{1,50}/).join("<wbr>"), sanitized_string
+    assert sanitized_string.is_a?(ActiveSupport::SafeBuffer)
+  end
+end