diff --git a/app/assets/javascripts/alchemy/alchemy.link_dialog.js.coffee b/app/assets/javascripts/alchemy/alchemy.link_dialog.js.coffee index a90a55179c..0e98029d37 100644 --- a/app/assets/javascripts/alchemy/alchemy.link_dialog.js.coffee +++ b/app/assets/javascripts/alchemy/alchemy.link_dialog.js.coffee @@ -129,10 +129,11 @@ class window.Alchemy.LinkDialog extends Alchemy.Dialog # Sets the link either in TinyMCE or on an Ingredient. setLink: (url, title, target) -> + trimmedUrl = url.trim() if @link_object.editor - @setTinyMCELink(url, title, target) + @setTinyMCELink(trimmedUrl, title, target) else - @link_object.setLink(url, title, target, @link_type) + @link_object.setLink(trimmedUrl, title, target, @link_type) return # Sets a link in TinyMCE editor. diff --git a/lib/alchemy/scrubbers/safe_list.rb b/lib/alchemy/scrubbers/safe_list.rb index 8a97b3d728..7b1a9c5667 100644 --- a/lib/alchemy/scrubbers/safe_list.rb +++ b/lib/alchemy/scrubbers/safe_list.rb @@ -13,7 +13,9 @@ def initialize(config) def scrub(node) return CONTINUE if sanitize(node) == CONTINUE - + if Loofah::HTML5::Scrub.allowed_element?(node.name) + node.before(node.children) + end node.remove STOP end diff --git a/spec/libraries/alchemy/scrubbers/safe_list_spec.rb b/spec/libraries/alchemy/scrubbers/safe_list_spec.rb index e821e1f65e..34d7ee5dca 100644 --- a/spec/libraries/alchemy/scrubbers/safe_list_spec.rb +++ b/spec/libraries/alchemy/scrubbers/safe_list_spec.rb @@ -12,31 +12,58 @@ context "with a tag that is not allowed" do let(:html) { "" } - it { is_expected.to eq("") } + it "removes the tag" do + is_expected.to eq("") + end + end + + context "with an iframe" do + let(:html) { "" } + + it "removes the tag" do + is_expected.to eq("") + end end context "with an allowed tag" do let(:html) { "

Some text

" } - it { is_expected.to eq(html) } + it "does not remove the tag" do + is_expected.to eq(html) + end end context "with an allowed attribute" do let(:html) { "

Some text

" } - it { is_expected.to eq(html) } + it "does not remove the attribute" do + is_expected.to eq(html) + end end context "with a disallowed attribute" do let(:html) { "

Some text

" } - it { is_expected.to eq("

Some text

") } + it "removes the attribute" do + is_expected.to eq("

Some text

") + end end context "with a link with a space in the href" do let(:html) { "Hello!" } - it { is_expected.to eq(html) } + it "does not escape the trailing whitespace" do + is_expected.to eq(html) + end + end + + context "with a node nested in a disallowed node" do + let(:config) { {safe_tags: ["a"]} } + let(:html) { "

Hello!

" } + + it "keeps the nested node" do + is_expected.to eq("Hello!") + end end end end