Skip to content

Commit

Permalink
Replace sanitize with raw for legacy document list
Browse files Browse the repository at this point in the history
`sanitize` was stripping out the `tabindex` attribute from the legacy document
list markup provided by Whitehall. `sanitize` requires an allowlist of
attributes, but a more future-proof option is to use `raw` since this is markup
from a trusted source.
  • Loading branch information
injms committed Mar 4, 2021
1 parent 35d03b8 commit 1e95b87
Showing 1 changed file with 1 addition and 4 deletions.
5 changes: 1 addition & 4 deletions app/views/content_items/_attachments.html.erb
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,7 @@
<%= render 'govuk_publishing_components/components/govspeak', {
direction: page_text_direction,
} do %>
<%= sanitize(legacy_pre_rendered_documents, {
attributes: %w(alt class href id src data-module data-track-category data-track-action data-track-label data-track-options data-details-track-click aria-hidden),
tags: %w(a details div h2 h3 img p section span summary),
}) %>
<%= raw(legacy_pre_rendered_documents) %>
<% end %>
<% else %>
<% attachments.each do |attachment_id| %>
Expand Down

0 comments on commit 1e95b87

Please sign in to comment.