From 0d438d05bc25b0e4719aa2aebc7c77128fc9a823 Mon Sep 17 00:00:00 2001
From: Dante Soares <dante.m.soares@rice.edu>
Date: Fri, 29 Apr 2022 15:38:10 -0500
Subject: [PATCH 1/2] Removed auto-links and the Rinku gem

---
 Gemfile                    |  3 ---
 Gemfile.lock               |  2 --
 lib/user_html.rb           |  9 ++++-----
 spec/lib/user_html_spec.rb | 20 ++++++++++----------
 4 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/Gemfile b/Gemfile
index a6b3536f..5b821448 100644
--- a/Gemfile
+++ b/Gemfile
@@ -41,9 +41,6 @@ gem 'rails-html-sanitizer'
 # URI replacement
 gem 'addressable'
 
-# Converts links in Strings to HTML anchors
-gem 'rinku'
-
 # Sanitizes user content
 gem 'sanitize'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 9c973713..875fcb14 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -399,7 +399,6 @@ GEM
       actionpack (>= 5.0)
       railties (>= 5.0)
     rexml (3.2.5)
-    rinku (2.0.6)
     roar (1.0.3)
       representable (>= 2.0.1, <= 3.0.0)
     roar-rails (1.0.1)
@@ -589,7 +588,6 @@ DEPENDENCIES
   redis
   representable (~> 3.0.0)
   request_store
-  rinku
   roar (= 1.0.3)
   roo
   rspec-instafail
diff --git a/lib/user_html.rb b/lib/user_html.rb
index 5768cd89..07cb7071 100644
--- a/lib/user_html.rb
+++ b/lib/user_html.rb
@@ -1,16 +1,15 @@
 module UserHtml
   mattr_accessor :sanitize_config
 
-  def self.link_and_sanitize(content)
-    linked_content = Rinku.auto_link(content, :urls)
-    Sanitize.fragment(linked_content, UserHtml.sanitize_config)
+  def self.sanitize(content)
+    Sanitize.fragment(content, UserHtml.sanitize_config)
   end
 
   module ActiveRecord
     module Base
       def user_html(*attributes)
         attributes.each do |attribute|
-          filter_name = :"link_and_sanitize_#{attribute.to_s}"
+          filter_name = :"sanitize_#{attribute.to_s}"
 
           class_exec do
             before_validation filter_name
@@ -19,7 +18,7 @@ def user_html(*attributes)
               content = send(attribute)
               return if content.nil?
 
-              send("#{attribute}=", UserHtml.link_and_sanitize(content))
+              send("#{attribute}=", UserHtml.sanitize(content))
             end
           end
         end
diff --git a/spec/lib/user_html_spec.rb b/spec/lib/user_html_spec.rb
index 046f5b77..c1934a77 100644
--- a/spec/lib/user_html_spec.rb
+++ b/spec/lib/user_html_spec.rb
@@ -7,7 +7,7 @@
 
   it 'converts url\'s to html anchors with rel="nofollow" and target="_blank"' do
     content = 'Here is a cool link: http://www.example.com.'
-    expect(described_class.link_and_sanitize(content)).to(
+    expect(described_class.sanitize(content)).to(
       eq 'Here is a cool link: <a href="http://www.example.com" ' +
          'rel="nofollow" target="_blank">http://www.example.com</a>.'
     )
@@ -15,7 +15,7 @@
 
   it 'adds rel="nofollow" and target="_blank" to existing html anchors' do
     content = 'Here is a cooler link: <a href="https://www.example.com">Example</a>.'
-    expect(described_class.link_and_sanitize(content)).to(
+    expect(described_class.sanitize(content)).to(
       eq 'Here is a cooler link: <a href="https://www.example.com" ' +
          'rel="nofollow" target="_blank">Example</a>.'
     )
@@ -23,7 +23,7 @@
 
   it 'removes script tags' do
     content = 'Have a cup of <script>1337 $cr1pt</script>.'
-    expect(described_class.link_and_sanitize(content)).to eq 'Have a cup of .'
+    expect(described_class.sanitize(content)).to eq 'Have a cup of .'
   end
 
   it 'allows iframes to whitelisted domains' do
@@ -34,7 +34,7 @@
                                'src="https://www.youtube.com/embed/Xp6V_lO1ZKA" frameborder="0" ' +
                                'allowfullscreen=""></iframe>'
 
-    expect(described_class.link_and_sanitize(youtube_content)).to eq expected_youtube_content
+    expect(described_class.sanitize(youtube_content)).to eq expected_youtube_content
 
     khan_content = \
       "<a style=\"color: #111; font-family: helvetica;\" target=\"_blank\" " +
@@ -57,7 +57,7 @@
       "src=\"https://www.khanacademy.org/embed_video?v=Xp6V_lO1ZKA\" allowfullscreen=\"\" " +
       "webkitallowfullscreen=\"\" mozallowfullscreen=\"\"></iframe>"
 
-    expect(described_class.link_and_sanitize(khan_content)).to eq expected_khan_content
+    expect(described_class.sanitize(khan_content)).to eq expected_khan_content
 
   end
 
@@ -68,7 +68,7 @@
       https://server2.cnx.org/content
     }
     valid_urls.each do | url |
-      expect(described_class.link_and_sanitize(
+      expect(described_class.sanitize(
               "<iframe src='#{url}' />"
             )).to eq  "<iframe src=\"#{url}\"></iframe>"
     end
@@ -76,7 +76,7 @@
 
   it 'removes iframes to non-whitelisted domains' do
     content = "Funny cat videos: <iframe src=\"http://mal.icio.us\">"
-    expect(described_class.link_and_sanitize(content)).to eq 'Funny cat videos: '
+    expect(described_class.sanitize(content)).to eq 'Funny cat videos: '
   end
 
   describe 'data-math attribute' do
@@ -84,17 +84,17 @@
 
     it 'is allowed on divs' do
       content = "as a block: <div data-math='#{formula}'/>"
-      expect(described_class.link_and_sanitize(content)).to eq "as a block: <div data-math=\"#{formula}\"></div>"
+      expect(described_class.sanitize(content)).to eq "as a block: <div data-math=\"#{formula}\"></div>"
     end
 
     it 'is allowed on spans' do
       content = "as inline: <span data-math='#{formula}'/>"
-      expect(described_class.link_and_sanitize(content)).to eq "as inline: <span data-math=\"#{formula}\"></span>"
+      expect(described_class.sanitize(content)).to eq "as inline: <span data-math=\"#{formula}\"></span>"
     end
 
     it 'is removed from other elements' do
       content = "also: <p data-math='#{formula}'/>"
-      expect(described_class.link_and_sanitize(content)).to eq 'also: <p></p>'
+      expect(described_class.sanitize(content)).to eq 'also: <p></p>'
     end
 
   end

From 5b3ae654a51f97f4e9c65990034daed166e9986e Mon Sep 17 00:00:00 2001
From: Dante Soares <dante.m.soares@rice.edu>
Date: Fri, 29 Apr 2022 16:23:45 -0500
Subject: [PATCH 2/2] Fixed failing auto_link test

---
 spec/lib/user_html_spec.rb | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/spec/lib/user_html_spec.rb b/spec/lib/user_html_spec.rb
index c1934a77..2eef7181 100644
--- a/spec/lib/user_html_spec.rb
+++ b/spec/lib/user_html_spec.rb
@@ -5,12 +5,9 @@
     expect(ActiveRecord::Base).to respond_to(:user_html)
   end
 
-  it 'converts url\'s to html anchors with rel="nofollow" and target="_blank"' do
+  it 'does not auto_link urls' do
     content = 'Here is a cool link: http://www.example.com.'
-    expect(described_class.sanitize(content)).to(
-      eq 'Here is a cool link: <a href="http://www.example.com" ' +
-         'rel="nofollow" target="_blank">http://www.example.com</a>.'
-    )
+    expect(described_class.sanitize(content)).to eq content
   end
 
   it 'adds rel="nofollow" and target="_blank" to existing html anchors' do