Don't blindly mark flash strings HTML safe

[no-reply]

This view partial had originally marked all of the strings it received as #html_safe, effectively trusting all content. Using sanitize essentially does the opposite: distrusting all flash message content. Any tags or attributes not in the whitelist (https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/whitelist.rb) will be removed, regardless of the source.

This seems like the best solution, since flash messages are serialized as strings, so the providers cannot give us carefully constructed #html_safe strings. In general, flash messages shouldn't require markup more complex than basic formatting and links.

Fixes #3228
Connected to #3187

Changes proposed in this pull request:

• Remove map(&:html_safe)!!!
• Call sanitize on flash messages

Guidance for testing, such as acceptance criteria or new user interface behaviors:

• Verify that this fixes Vulnerability 2 in Cross-site scripting vulnerabilities #3187.

@samvera/hyrax-code-reviewers

[jcoyne]

If I recall correctly, there is no way for flash messages, which get serialized into the session to be marked as HTML safe. I believe there are one or two places where we've inserted html link tags into the flash, so this change may break those links.

[jcoyne]

How about calling sanitize() on the flash? See: https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

[no-reply]

@jcoyne I think I follow. Since the flash messages are serialized into the session using the JSON serializer, they come out as strings, even if there were originally safe buffers?

Yeah, it seems like sanitize and a conservative whitelisted scrubber are the way to go here.

Do we have any example flash messages with HTML formatting?

[jcoyne]

@no-reply that's what I'm thinking. Sorry, I don't know where we have html in the flash though. Maybe these?

$ git grep flash app/controllers/|grep html
app/controllers/concerns/hyrax/works_controller_behavior.rb:            flash[:notice] = view_context.t('hyrax.works.create.after_create_html', application_name: view_context.application_name)
app/controllers/hyrax/batch_uploads_controller.rb:        flash[:notice] = view_context.t('hyrax.works.create.after_create_html', application_name: view_context.application_name)