From 2b9c4d9b715b9df2bab73598d8e1b0c5c41be642 Mon Sep 17 00:00:00 2001
From: Jose Farias <jose@37signals.com>
Date: Fri, 29 Nov 2024 18:00:50 -0600
Subject: [PATCH] Sanitize rendered markdown

---
 app/views/comments/_comment.html.erb | 2 +-
 config/initializers/sanitization.rb  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 config/initializers/sanitization.rb

diff --git a/app/views/comments/_comment.html.erb b/app/views/comments/_comment.html.erb
index 7efab5588..98c37b6cb 100644
--- a/app/views/comments/_comment.html.erb
+++ b/app/views/comments/_comment.html.erb
@@ -13,7 +13,7 @@
       <% end %>
     </div>
     <div class="comment__body txt-align-start">
-      <%= comment.body_html %>
+      <%= sanitize comment.body_html %>
     </div>
   </div>
 <% end %>
diff --git a/config/initializers/sanitization.rb b/config/initializers/sanitization.rb
new file mode 100644
index 000000000..961a62083
--- /dev/null
+++ b/config/initializers/sanitization.rb
@@ -0,0 +1,3 @@
+Rails.application.config.after_initialize do
+  Rails::HTML5::SafeListSanitizer.allowed_tags.merge(%w[ table tr td th thead tbody details summary ])
+end