diff --git a/app/helpers/reports_helper.rb b/app/helpers/reports_helper.rb index 5fa20a09e..6bb8fc701 100644 --- a/app/helpers/reports_helper.rb +++ b/app/helpers/reports_helper.rb @@ -99,4 +99,12 @@ module ReportsHelper end "#{text}".html_safe end + + def sanitize_report_pdf(text, tags = [], attributes = []) + ActionController::Base.helpers.sanitize( + text, + tags: Constants::WHITELISTED_TAGS + tags, + attributes: Constants::WHITELISTED_ATTRIBUTES + attributes + ) + end end diff --git a/app/views/reports/report.pdf.erb b/app/views/reports/report.pdf.erb index fb6e33ea7..36812a514 100644 --- a/app/views/reports/report.pdf.erb +++ b/app/views/reports/report.pdf.erb @@ -10,7 +10,7 @@
<% # Also whitelist and tags %> - <%= sanitize_input(@html, ['img', 'input'], ['type', 'disabled', 'checked']) %> + <%= sanitize_report_pdf(@html, ['img', 'input'], ['type', 'disabled', 'checked']) %>