Merge pull request #595 from sgmap/remove_html_safe

Remove html safe
2017-07-13 10:38:09 +02:00 · 2017-07-13 10:38:09 +02:00 · bf775b4b2b
commit bf775b4b2b
parent 1234d028d7 c68b4e9cf6
25 changed files with 38 additions and 37 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -56,7 +56,7 @@ jobs:
            bundle exec rspec --color --require spec_helper -- ${TESTFILES}
      - run:
          name: Run rubocop
-          command: bundle exec rubocop
+          command: bundle exec rubocop -R
      - run:
          name: Run haml-lint
          command: bundle exec haml-lint app/views/
--- a/.rubocop.yml
+++ b/.rubocop.yml
@ -570,7 +570,7 @@ Rails/Output:
  Enabled: false

 Rails/OutputSafety:
-  Enabled: false
+  Enabled: true

 Rails/PluralizationGrammar:
  Enabled: false
--- a/app/controllers/admin/gestionnaires_controller.rb
+++ b/app/controllers/admin/gestionnaires_controller.rb
@ -48,7 +48,7 @@ class Admin::GestionnairesController < AdminController
      flash.notice = 'Accompagnateur ajouté'
      GestionnaireMailer.new_gestionnaire(@gestionnaire.email, @gestionnaire.password).deliver_now!
    else
-      flash.alert = @gestionnaire.errors.full_messages.join('<br />').html_safe
+      flash.alert = @gestionnaire.errors.full_messages
    end
  end

--- a/app/controllers/admin/procedures_controller.rb
+++ b/app/controllers/admin/procedures_controller.rb
@ -71,7 +71,7 @@ class Admin::ProceduresController < AdminController
    @procedure.module_api_carto = ModuleAPICarto.new(create_module_api_carto_params) if @procedure.valid?

    unless @procedure.save
-      flash.now.alert = @procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = @procedure.errors.full_messages
      return render 'new'
    end

@ -83,7 +83,7 @@ class Admin::ProceduresController < AdminController
    @procedure = current_administrateur.procedures.find(params[:id])

    unless @procedure.update_attributes(procedure_params)
-      flash.now.alert = @procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = @procedure.errors.full_messages
      return render 'edit'
    end

@ -166,7 +166,7 @@ class Admin::ProceduresController < AdminController
      flash.notice = 'Procédure clonée'
      redirect_to edit_admin_procedure_path(id: new_procedure.id)
    else
-      flash.now.alert = procedure.errors.full_messages.join('<br />').html_safe
+      flash.now.alert = procedure.errors.full_messages
      render 'index'
    end

--- a/app/controllers/administrations_controller.rb
+++ b/app/controllers/administrations_controller.rb
@ -20,7 +20,7 @@ class AdministrationsController < ApplicationController
      flash.notice = "Administrateur créé"
      NewAdminMailer.new_admin_email(admin).deliver_now!
    else
-      flash.alert = admin.errors.full_messages.join('<br>').html_safe
+      flash.alert = admin.errors.full_messages
    end

    redirect_to administrations_path
--- a/app/controllers/commentaires_controller.rb
+++ b/app/controllers/commentaires_controller.rb
@ -32,7 +32,7 @@ class CommentairesController < ApplicationController
      if pj.errors.empty?
        @commentaire.piece_justificative = pj
      else
-        flash.alert = pj.errors.full_messages.join("<br>").html_safe
+        flash.alert = pj.errors.full_messages
      end
    end

--- a/app/controllers/invites_controller.rb
+++ b/app/controllers/invites_controller.rb
@ -18,7 +18,7 @@ class InvitesController < ApplicationController

      flash.notice = "Invitation envoyée (#{invite.email})"
    else
-      flash.alert = invite.errors.full_messages.join('<br />').html_safe
+      flash.alert = invite.errors.full_messages
    end

    if gestionnaire_signed_in?
--- a/app/controllers/users/description_controller.rb
+++ b/app/controllers/users/description_controller.rb
@ -69,16 +69,16 @@ class Users::DescriptionController < UsersController
      unless params[:cerfa_pdf].nil?
        cerfa = Cerfa.new(content: params[:cerfa_pdf], dossier: @dossier, user: current_user)
        unless cerfa.save
-          flash.alert = cerfa.errors.full_messages.join('<br />').html_safe
+          flash.alert = cerfa.errors.full_messages
        end
      end
    end

    if !((errors_upload = PiecesJustificativesService.upload!(@dossier, current_user, params)).empty?)
      if flash.alert.nil?
-        flash.alert = errors_upload.join('<br>').html_safe
+        flash.alert = errors_upload
      else
-        flash.alert = (flash.alert + '<br />' + errors_upload.join('<br>').html_safe).html_safe
+        flash.alert = [flash.alert] + errors_upload
      end

    else
@ -100,7 +100,7 @@ class Users::DescriptionController < UsersController
  private

  def redirect_to_description_with_errors(dossier, errors)
-    flash.alert = errors.join('<br>')
+    flash.alert = errors
    redirect_to users_dossier_description_path(dossier_id: dossier.id)
  end

--- a/app/controllers/users/dossiers_controller.rb
+++ b/app/controllers/users/dossiers_controller.rb
@ -133,7 +133,7 @@ class Users::DossiersController < UsersController

    if checked_autorisation_donnees?
      unless Dossier.find(@facade.dossier.id).update_attributes update_params_with_formatted_birthdate
-        flash.alert = @facade.dossier.errors.full_messages.join('<br />').html_safe
+        flash.alert = @facade.dossier.errors.full_messages

        return redirect_to users_dossier_path(id: @facade.dossier.id)
      end
--- a/app/decorators/champ_decorator.rb
+++ b/app/decorators/champ_decorator.rb
@ -14,6 +14,6 @@ class ChampDecorator < Draper::Decorator
  end

  def description_with_links
-    description.gsub(URI.regexp, '<a target="_blank" href="\0">\0</a>').html_safe if description
+    description.gsub(URI.regexp, '<a target="_blank" href="\0">\0</a>') if description
  end
 end
--- a/app/views/admin/pieces_justificatives/show.js.erb
+++ b/app/views/admin/pieces_justificatives/show.js.erb
@ -1,4 +1,4 @@
 <% flash.each do |type, message| %>
-$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= message.html_safe %></div>").children().fadeOut(5000)
+$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= sanitize(message) %></div>").children().fadeOut(5000)
 <%  end %>
 $('#piece_justificative_form').html("<%= escape_javascript(render partial: 'form', locals: { procedure: @procedure } ) %>");
--- a/app/views/admin/procedures/show.html.haml
+++ b/app/views/admin/procedures/show.html.haml
@ -60,7 +60,7 @@
        %h4.text-info
          = @facade.procedure.libelle

-        = h @facade.procedure.description.html_safe
+        = h sanitize(@facade.procedure.description)

      .champs.col-xs-6.col-md-3
        %h4.text-info
--- a/app/views/admin/procedures/transfer.js.erb
+++ b/app/views/admin/procedures/transfer.js.erb
@ -2,7 +2,7 @@
  transfer_errors_message(true);
 <%- else %>
  $("#main-container").prepend("<div class='row'><div id='flash_message'></div></div>");
-  $("#flash_message").prepend("<div class=\"alert alert-success\"> <%= flash.notice.html_safe %></div>");
+  $("#flash_message").prepend("<div class=\"alert alert-success\"> <%= sanitize(flash.notice) %></div>");
  <% flash.clear %>

  transfer_errors_message(false);
--- a/app/views/admin/types_de_champ/show.js.erb
+++ b/app/views/admin/types_de_champ/show.js.erb
@ -1,5 +1,5 @@
 <% flash.each do |type, message| %>
-$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= message.html_safe %></div>").children().fadeOut(5000)
+$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= sanitize(message) %></div>").children().fadeOut(5000)
 <%  end %>
 $('#liste-champ').html("<%= escape_javascript(render partial: 'admin/types_de_champ/form', locals: { procedure: @procedure, types_de_champ: @types_de_champ } ) %>");
 on_change_type_de_champ_select ();
--- a/app/views/backoffice/dossiers/_list.html.haml
+++ b/app/views/backoffice/dossiers/_list.html.haml
@ -53,7 +53,7 @@

        %td.center
          - if current_gestionnaire.follow?(dossier.id)
-            = link_to('Quitter'.html_safe, backoffice_dossier_follow_path(dossier_id: dossier.id), 'data-method' => :put, class: 'btn-sm btn-danger', id: "suivre_dossier_#{dossier.id}")
+            = link_to('Quitter', backoffice_dossier_follow_path(dossier_id: dossier.id), 'data-method' => :put, class: 'btn-sm btn-danger', id: "suivre_dossier_#{dossier.id}")
          - else
            = link_to('Suivre', backoffice_dossier_follow_path(dossier_id: dossier.id), 'data-method' => :put, class: 'btn-sm btn-primary', id: "suivre_dossier_#{dossier.id}")
        %td.center{ style: "color: #{dossier.total_follow == 0 ? 'red' : ''}" }
--- a/app/views/backoffice/dossiers/formulaire_private.js.erb
+++ b/app/views/backoffice/dossiers/formulaire_private.js.erb
@ -1,4 +1,4 @@
 <% flash.each do |type, message| %>
-$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= message.html_safe %></div>").children().fadeOut(5000)
+$("#flash_message").html("<div class=\"alert alert-success move-up\" style=\"display: block:\"> <%= sanitize(message) %></div>").children().fadeOut(5000)
 <%  end %>
 <% flash.clear %>
--- a/app/views/dossiers/etapes/_etape1.html.haml
+++ b/app/views/dossiers/etapes/_etape1.html.haml
@ -16,9 +16,9 @@
        = @facade.procedure.libelle

      %p#description_procedure{ style: 'width: 95%;', class: (@facade.entreprise.nil? ? '' : 'mask') }
-        = h @facade.procedure.description.html_safe
+        = h sanitize(@facade.procedure.description)

        - unless @facade.procedure.lien_site_web.blank?
          .center
-            %a{ href: "#{@facade.procedure.lien_site_web.html_safe}", target: '_blank' }
+            %a{ href: @facade.procedure.lien_site_web, target: '_blank' }
              En savoir plus ...
--- a/app/views/dossiers/etapes/etape_2/_individual.html.haml
+++ b/app/views/dossiers/etapes/etape_2/_individual.html.haml
@ -36,8 +36,7 @@
        %p
          %label{ style: 'font-weight: normal;' }
            = f.check_box :autorisation_donnees
-            = "&nbsp;".html_safe
-            Vos informations personnelles ne seront jamais utilisées dans un but lucratif ou commercial. Elles ne pourront être communiquées à de tierces personnes sans votre accord préalable. Elles pourront en revanche être communiquées aux administrations compétentes afin d'instruire votre dossier, conformément à la déclaration CNIL effectuée par le service TPS.
+             Vos informations personnelles ne seront jamais utilisées dans un but lucratif ou commercial. Elles ne pourront être communiquées à de tierces personnes sans votre accord préalable. Elles pourront en revanche être communiquées aux administrations compétentes afin d'instruire votre dossier, conformément à la déclaration CNIL effectuée par le service TPS.
            = link_to 'en savoir plus', cgu_path, target: '_blank'
    .row
      .col-xs-5.col-xs-5
--- a/app/views/gestionnaire_mailer/last_week_overview.html.haml
+++ b/app/views/gestionnaire_mailer/last_week_overview.html.haml
@ -23,9 +23,10 @@
              dont <span style='font-weight: bold; color: #FF5D60; padding: 2px 0;' >#{procedure_overview.old_dossiers_en_construction.count}</span> depuis plus de 7 jours
              - if procedure_overview.old_dossiers_en_construction.count < 6
                \:
-                = procedure_overview.old_dossiers_en_construction.map do |old_dossier|
+                - old_dossiers_en_construction = procedure_overview.old_dossiers_en_construction.map do |old_dossier|
                  - link_to "nº #{old_dossier.id}", backoffice_dossier_url(old_dossier), style: 'color: #4393F3;'
-                - end.join(', ').html_safe
+                - end.join(', ')
+                = sanitize(old_dossiers_en_construction, attributes: %w(href style))

      - if procedure_overview.dossiers_en_instruction_count > 0
        %tr
@ -36,9 +37,10 @@
              dont <span style='font-weight: bold; color: #FF5D60; padding: 2px 0;' >#{procedure_overview.old_dossiers_en_instruction.count}</span> depuis plus de 7 jours
              - if procedure_overview.old_dossiers_en_instruction.count < 6
                \:
-                = procedure_overview.old_dossiers_en_instruction.map do |old_dossier|
+                - old_dossiers_en_instruction = procedure_overview.old_dossiers_en_instruction.map do |old_dossier|
                  - link_to "nº #{old_dossier.id}", backoffice_dossier_url(old_dossier), style: 'color: #4393F3;'
-                - end.join(', ').html_safe
+                - end.join(', ')
+                = sanitize(old_dossiers_en_instruction, attributes: %w(href style))

  - if index != (@args[:procedure_overviews].count - 1)
    .spacer{ style: 'border-bottom: 1px solid #CCC; margin: 25px 0 30px;' }
--- a/app/views/layouts/_flash_messages.html.haml
+++ b/app/views/layouts/_flash_messages.html.haml
@ -4,8 +4,8 @@
      - if value.class == Array
        .alert{ class: flash_class(key) }
          - value.each do |message|
-            = message
+            = sanitize(message)
            %br
      - else
        .alert{ class: flash_class(key) }
-          = value
+          = sanitize(value)
--- a/app/views/layouts/_ie_lt_10.html.haml
+++ b/app/views/layouts/_ie_lt_10.html.haml
@ -1,8 +1,8 @@
-= "<!--[if lt IE 10]>".html_safe
+<!--[if lt IE 10]>

 .center{ style: 'width: 100%; background-color: white; position: fixed; top: 0; left: 0; z-index: 100000;' }
  %h3.text-danger
    %b
      Votre version d'Internet Explorer est trop ancienne pour être utilisée sur le service TPS. Version minimum : Internet Explorer 10

-= "<![endif]-->".html_safe
+<![endif]-->
--- a/app/views/users/description/champs/_render_list_champs.html.haml
+++ b/app/views/users/description/champs/_render_list_champs.html.haml
@ -60,4 +60,4 @@

          - unless champ.description.empty?
            %div{ id: "description_champs_#{champ.id}", class: ('help-block' unless champ.type_champ == 'engagement') }
-              = champ.description_with_links
+              = sanitize(champ.description_with_links, attributes: %w(href target))
--- a/app/views/users/sessions/_resume_procedure.html.haml
+++ b/app/views/users/sessions/_resume_procedure.html.haml
@ -13,7 +13,7 @@
      %h2#titre-procedure.text-info
        = @dossier.procedure.libelle
      %p.procedure-description
-        = h @dossier.procedure.description.html_safe
+        = h sanitize(@dossier.procedure.description)

 - else
  #logo_procedure.flag
--- a/app/views/users/sessions/new.html.haml
+++ b/app/views/users/sessions/new.html.haml
@ -20,7 +20,7 @@
        %h2.procedure-title
          = @dossier.procedure.libelle
        %p.procedure-description
-          = h @dossier.procedure.description.html_safe
+          = h sanitize(@dossier.procedure.description)

    .column.auth-form
      = form_for @user, url: user_session_path, html: { class: "form" } do |f|
--- a/app/views/users/siret/_pro.html.haml
+++ b/app/views/users/siret/_pro.html.haml
@ -6,7 +6,7 @@
    = @procedure.libelle

  %p
-    = @procedure.description.html_safe
+    = sanitize(@procedure.description)

  %br
  = form_tag(url_for({ controller: :dossiers, action: :create }), class: 'form-inline', method: 'POST') do |f|