From b8bcfdee407e3dfcc584cdbf9f04f36083973799 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Sun, 6 Apr 2025 13:29:43 +0200 Subject: [PATCH] This is not just param extraction, we sanitize too --- app/controllers/bubbles/taggings_controller.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/bubbles/taggings_controller.rb b/app/controllers/bubbles/taggings_controller.rb index b6fb96df0..44a1a1a71 100644 --- a/app/controllers/bubbles/taggings_controller.rb +++ b/app/controllers/bubbles/taggings_controller.rb @@ -6,11 +6,11 @@ class Bubbles::TaggingsController < ApplicationController end def create - @bubble.toggle_tag_with(tag_title_param) + @bubble.toggle_tag_with(sanitized_tag_title_param) end private - def tag_title_param + def sanitized_tag_title_param params.required(:tag_title).strip.gsub(/\A#/, "") end end