diff --git a/app/views/comments/_comment.html.erb b/app/views/comments/_comment.html.erb index 7efab5588..98c37b6cb 100644 --- a/app/views/comments/_comment.html.erb +++ b/app/views/comments/_comment.html.erb @@ -13,7 +13,7 @@ <% end %>
- <%= comment.body_html %> + <%= sanitize comment.body_html %>
<% end %> diff --git a/config/initializers/sanitization.rb b/config/initializers/sanitization.rb new file mode 100644 index 000000000..961a62083 --- /dev/null +++ b/config/initializers/sanitization.rb @@ -0,0 +1,3 @@ +Rails.application.config.after_initialize do + Rails::HTML5::SafeListSanitizer.allowed_tags.merge(%w[ table tr td th thead tbody details summary ]) +end