Fix the field sanitization

.github/workflows/test.yml

@@ -37,6 +37,10 @@ jobs:
         with:
           fetch-depth: 1
 
+      - uses: nanasess/setup-chromedriver@v2
+        with:
+          chromedriver-version: 119.0.6045.105
+
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ env.RUBY_VERSION }}

app/cells/decidim/participatory_documents/suggestion/admin_answer.erb

@@ -3,5 +3,5 @@
       <strong><%= answered_at %></strong>
       <strong><%= t("suggestion_answer", scope: "decidim.participatory_documents.document") %></strong>
     </div>
-  <%= translated_attribute(model.answer) %>
+  <%= sanitize translated_attribute(model.answer) %>
 </div>

app/views/decidim/participatory_documents/documents/index.html.erb

@@ -1,7 +1,7 @@
 <% if document.present? && document.file.attached? %>
   <div class="row">
-    <%= content_tag(:h3, translated_attribute(document.title), class: "title") if translated_attribute(document.title).present? %>
-    <%= content_tag(:p, translated_attribute(document.description).html_safe, class: "description") if translated_attribute(document.description).present? %>
+    <%= content_tag(:h3, sanitize(translated_attribute(document.title)), class: "title") if translated_attribute(document.title).present? %>
+    <%= content_tag(:p, sanitize(translated_attribute(document.description)), class: "description") if translated_attribute(document.description).present? %>
     <% if preview_mode? %>
       <div class="callout announcement mb-sm warning cell-announcement">
         <p class="heading5"><%= t("decidim.participatory_documents.documents.preview_title") %></p>

spec/system/index_participatory_documents_spec.rb

@@ -58,6 +58,17 @@
     end
   end
 
+  context "when the document has a description with potential XSS" do
+    let!(:title) { '<p>Safe title text<img src="about:blank" onerror="alert(777)"></p>' }
+    let!(:description) { '<p>Safe description text<img src="about:blank" onerror="alert(777)"></p>' }
+
+    it "show sanitized title and description" do
+      expect(page).to have_content("Safe title text")
+      expect(page).to have_content("Safe description text")
+      expect { page.driver.browser.switch_to.alert }.to raise_error(Selenium::WebDriver::Error::NoSuchAlertError)
+    end
+  end
+
   # TODO: Fix this test
   # context "when user goes to fullscreen mode" do
   #   it "changes button text and class" do

spec/system/user_interacts_with_pdf_viewer_spec.rb

@@ -271,4 +271,21 @@
       end
     end
   end
+
+  context "when the suggestion answer has a text with potential XSS" do
+    let!(:document) { create :participatory_documents_document, :with_file, component: component }
+    let!(:suggestion) { create(:participatory_documents_suggestion, :published, author: document.author, suggestable: document, answer: { en: answer }) }
+    let!(:answer) { '<p>Safe answer text<img src="about:blank" onerror="alert(777)"></p>' }
+
+    before do
+      login_as document.author, scope: :user
+      page.visit Decidim::EngineRouter.main_proxy(component).pdf_viewer_documents_path(file: document.attached_uploader(:file).path)
+      find("#globalSuggestionTrigger").click
+    end
+
+    it "show sanitized answer" do
+      expect(page).to have_content("Safe answer text")
+      expect { page.driver.browser.switch_to.alert }.to raise_error(Selenium::WebDriver::Error::NoSuchAlertError)
+    end
+  end
 end