diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 7d0babbe3f..89f54ca91f 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -144,8 +144,12 @@ def markdown_unsafe(source) end def sanitize(html) - @tags ||= Rails::Html::SafeListSanitizer.allowed_tags.to_a + %w[table thead tbody tr td th colgroup col style svg circle line rect path summary details] - @attributes ||= Rails::Html::SafeListSanitizer.allowed_attributes.to_a + %w[style target data-bs-toggle data-parent data-tab data-line data-element id x1 y1 x2 y2 stroke stroke-width fill cx cy r] + @tags ||= Rails::Html::SafeListSanitizer.allowed_tags.to_a + + %w[table thead tbody tr td th colgroup col style summary details] + + %w[svg g style circle line rect path polygon text] + @attributes ||= Rails::Html::SafeListSanitizer.allowed_attributes.to_a + + %w[style target data-bs-toggle data-parent data-tab data-line data-element id] + + %w[viewbox width height version style class transform id x y rx ry x1 y1 x2 y2 d points fill stroke stroke-width cx cy r font-size font-family font-weight font-variant] # Filters allowed tags and attributes sanitized = ActionController::Base.helpers.sanitize html, diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb index d5ae502096..95dfa15373 100644 --- a/test/helpers/application_helper_test.rb +++ b/test/helpers/application_helper_test.rb @@ -96,6 +96,25 @@ class ApplicationHelperTest < ActiveSupport::TestCase assert_equal dirty_html, clean_html end + test 'sanitize helper should allow a selection of svg tags' do + dirty_html = <<~HTML + + + + + + + + + + + Hello + + HTML + clean_html = sanitize dirty_html + assert_equal dirty_html, clean_html + end + test 'language tags are used correctly' do def current_user create :user