diff --git a/app/helpers/input_sanitize_helper.rb b/app/helpers/input_sanitize_helper.rb index 3137ab392..35b56be3d 100644 --- a/app/helpers/input_sanitize_helper.rb +++ b/app/helpers/input_sanitize_helper.rb @@ -1,9 +1,13 @@ module InputSanitizeHelper - def sanitize_input(text) + def sanitize_input( + text, + tags = [], + attributes = [] + ) ActionController::Base.helpers.sanitize( text, - tags: Constants::WHITELISTED_TAGS, - attributes: Constants::WHITELISTED_ATTRIBUTES + tags: Constants::WHITELISTED_TAGS + tags, + attributes: Constants::WHITELISTED_ATTRIBUTES + attributes ) end diff --git a/app/views/reports/report.pdf.erb b/app/views/reports/report.pdf.erb index 8ed7c223b..fb6e33ea7 100644 --- a/app/views/reports/report.pdf.erb +++ b/app/views/reports/report.pdf.erb @@ -9,7 +9,8 @@
- <%= sanitize_input(@html) %> + <% # Also whitelist and tags %> + <%= sanitize_input(@html, ['img', 'input'], ['type', 'disabled', 'checked']) %>