Merge pull request #590 from sgmap/fix_injection

Fix injection

app/views/dossiers/_infos_dossier.html.haml

@@ -52,7 +52,7 @@
                   - elsif champ.decorate.value == 'false'
                     Non
                 - else
-                  = champ.decorate.value.html_safe
+                  = sanitize(champ.decorate.value)
 
     - if @facade.dossier.mandataire_social && gestionnaire_signed_in?
       .mandataire_social.text-success.center

app/views/dossiers/commentaires/_commentaire.html.haml

@@ -2,7 +2,7 @@
   .comment-header
     = commentaire.header
   .content
-    = commentaire.body.html_safe
+    = sanitize(commentaire.body)
   - if file = commentaire.piece_justificative
     .file
       = link_to file.content_url, class: 'link', target: '_blank' do