# frozen_string_literal: true module Decidim # Helper that provides methods to render order selector and links module SanitizeHelper def self.included(base) base.include ActionView::Helpers::SanitizeHelper base.include ActionView::Helpers::TagHelper base.include Decidim::TranslatableAttributes end # Public: It sanitizes a user-inputted string with the # `Decidim::UserInputScrubber` scrubber, so that video embeds work # as expected. Uses Rails' `sanitize` internally. # # html - A string representing user-inputted HTML. # # Returns an HTML-safe String. def decidim_sanitize(html, options = {}) scrubber = options[:scrubber] || Decidim::UserInputScrubber.new if options[:strip_tags] strip_tags sanitize(html, scrubber: scrubber) else sanitize(html, scrubber: scrubber) end end def decidim_sanitize_admin(html, options = {}) decidim_sanitize(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options)) end def decidim_sanitize_newsletter(html, options = {}) if options[:strip_tags] strip_tags sanitize(html, scrubber: Decidim::NewsletterScrubber.new) else sanitize(html, scrubber: Decidim::NewsletterScrubber.new) end end def decidim_sanitize_editor(html, options = {}) content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor-display)) end def decidim_sanitize_editor_admin(html, options = {}) html = Decidim::IframeDisabler.new(html, options).perform decidim_sanitize_editor(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options)) end def decidim_html_escape(text) ERB::Util.unwrapped_html_escape(text.to_str) end def decidim_url_escape(text) decidim_html_escape(text).sub(/^javascript:/, "") end def decidim_sanitize_translated(text) decidim_sanitize(translated_attribute(text)) end def decidim_escape_translated(text) decidim_html_escape(translated_attribute(text)) end private # Maintains the paragraphs and lists separations with their bullet points and # list numberings where appropriate. # # Returns a String. def sanitize_text(text) add_line_feeds(sanitize_ordered_lists(sanitize_unordered_lists(text))) end def sanitize_unordered_lists(text) text.gsub(%r{(?=.*)(?!.*?