FIX: Render excerpt HTML for chat replies and edit (#22559)

It is now safe to render the message excerpt as HTML since
it is no longer using text_entities: true in the server
PrettyText.excerpt call when creating the message excerpt
from the cooked HTML.

This will fix the issue of things like mentions showing
HTML code instead of the actual mention when replying,
and cannot be used to inject improper HTML like style tags
via XSS.
This commit is contained in:
Martin Brennan
2023-07-13 09:44:56 +10:00
committed by GitHub
parent bdecd697b9
commit 4ae26bcaac
8 changed files with 56 additions and 8 deletions

View File

@ -3,7 +3,13 @@
RSpec.describe "Chat composer draft", type: :system do
fab!(:current_user) { Fabricate(:user) }
fab!(:channel_1) { Fabricate(:chat_channel) }
fab!(:message_1) { Fabricate(:chat_message, chat_channel: channel_1) }
fab!(:message_1) do
Fabricate(
:chat_message,
chat_channel: channel_1,
message: "This is a message for draft and replies",
)
end
let(:chat_page) { PageObjects::Pages::Chat.new }
let(:channel_page) { PageObjects::Pages::ChatChannel.new }