diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md index b616ab75018fe..ff042b648cb8e 100644 --- a/railties/CHANGELOG.md +++ b/railties/CHANGELOG.md @@ -1,3 +1,10 @@ +* Fix sanitizer vendor configuration in 7.1 defaults. + + In apps where rails-html-sanitizer was not eagerly loaded, the sanitizer default could end up + being Rails::HTML4::Sanitizer when it should be set to Rails::HTML5::Sanitizer. + + *Mike Dalessio*, *Rafael Mendonça França* + * Setup jemalloc in the default Dockerfile for memory optimization. *Matt Almeida*, *Jean Boussier* diff --git a/railties/lib/rails/application/configuration.rb b/railties/lib/rails/application/configuration.rb index edcbabccf3f49..1a50f377ac277 100644 --- a/railties/lib/rails/application/configuration.rb +++ b/railties/lib/rails/application/configuration.rb @@ -312,14 +312,14 @@ def load_defaults(target_version) active_support.raise_on_invalid_cache_expiration_time = true end - if defined?(Rails::HTML::Sanitizer) # nested ifs to avoid linter errors - if respond_to?(:action_view) - action_view.sanitizer_vendor = Rails::HTML::Sanitizer.best_supported_vendor - end + if respond_to?(:action_view) + require "rails-html-sanitizer" + action_view.sanitizer_vendor = Rails::HTML::Sanitizer.best_supported_vendor + end - if respond_to?(:action_text) - action_text.sanitizer_vendor = Rails::HTML::Sanitizer.best_supported_vendor - end + if respond_to?(:action_text) + require "rails-html-sanitizer" + action_text.sanitizer_vendor = Rails::HTML::Sanitizer.best_supported_vendor end when "7.2" load_defaults "7.1"