diff --git a/app/models/alchemy/essence_richtext.rb b/app/models/alchemy/essence_richtext.rb index 606b1af90b..f5c260a660 100644 --- a/app/models/alchemy/essence_richtext.rb +++ b/app/models/alchemy/essence_richtext.rb @@ -17,6 +17,7 @@ class EssenceRichtext < BaseRecord acts_as_essence preview_text_column: "stripped_body" before_save :strip_content + before_save :sanitize_content def has_tinymce? true @@ -27,5 +28,16 @@ def has_tinymce? def strip_content self.stripped_body = Rails::Html::FullSanitizer.new.sanitize(body) end + + def sanitize_content + self.sanitized_body = Rails::Html::SafeListSanitizer.new.sanitize( + body, + content_sanitizer_settings + ) + end + + def content_sanitizer_settings + content&.settings&.fetch(:sanitizer, {}) + end end end diff --git a/spec/dummy/config/alchemy/elements.yml b/spec/dummy/config/alchemy/elements.yml index f80cc2b97b..a5e0fca190 100644 --- a/spec/dummy/config/alchemy/elements.yml +++ b/spec/dummy/config/alchemy/elements.yml @@ -31,6 +31,11 @@ contents: - name: text type: EssenceRichtext + settings: + sanitizer: + attributes: [href, target] + tags: [p, ol, ul, ul, li, em, strong] + - name: search contents: [] diff --git a/spec/models/alchemy/essence_richtext_spec.rb b/spec/models/alchemy/essence_richtext_spec.rb index f60fbb43b1..1a070d67ec 100644 --- a/spec/models/alchemy/essence_richtext_spec.rb +++ b/spec/models/alchemy/essence_richtext_spec.rb @@ -4,13 +4,38 @@ module Alchemy describe EssenceRichtext do + let(:element) { create(:alchemy_element, name: "article") } + let(:content) { Alchemy::Content.new(name: "text", element: element) } let(:essence) do - EssenceRichtext.new(body: "

Hello!

Welcome to Peters Petshop.

") + Alchemy::EssenceRichtext.new( + content: content, + body: "

Hello!

Welcome to Peters Petshop.

" + ) end it_behaves_like "an essence" do - let(:essence) { EssenceRichtext.new } - let(:ingredient_value) { "

Hello!

Welcome to Peters Petshop.

" } + let(:essence) { EssenceRichtext.new(content: content) } + let(:ingredient_value) { "

Hello!

Welcome to Peters Petshop.

" } + end + + it "should save a HTML tag free version of body column" do + essence.save + expect(essence.stripped_body).to eq("Hello!Welcome to Peters Petshop.") + end + + it "should save a sanitized version of body column" do + essence.save + expect(essence.sanitized_body).to eq("

Hello!

Welcome to Peters Petshop.

") + end + + context "when class is not part of the allowed attributes" do + let(:element) { create(:alchemy_element, name: "text") } + let(:content) { Alchemy::Content.new(name: "text", element: element) } + + it "should save a sanitized version of body column" do + essence.save + expect(essence.sanitized_body).to eq("Hello!

Welcome to Peters Petshop.

") + end end it "should save a HTML tag free version of body column" do