- <%= render 'govuk_publishing_components/components/govspeak',
- { direction: page_text_direction, disable_youtube_expansions: true } do %>
- <%= raw @content_item.body %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ disable_youtube_expansions: true,
+ } do %>
+ <%= sanitize(@content_item.body) %>
<% end %>
<% if @content_item.last_updated && @content_item.schema_name == "help_page" %>
diff --git a/app/views/content_items/_document_collection_body.html.erb b/app/views/content_items/_document_collection_body.html.erb
index 20d96d501..c14e63f71 100644
--- a/app/views/content_items/_document_collection_body.html.erb
+++ b/app/views/content_items/_document_collection_body.html.erb
@@ -4,10 +4,13 @@
<% @content_item.groups.each_with_index do |group, group_index| %>
<%= @content_item.group_heading(group) %>
+
<% if group["body"].present? %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: raw(group["body"]),
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(group["body"]) %>
+ <% end %>
<% end %>
diff --git a/app/views/content_items/case_study.html.erb b/app/views/content_items/case_study.html.erb
index 4f541e883..86c927a7f 100644
--- a/app/views/content_items/case_study.html.erb
+++ b/app/views/content_items/case_study.html.erb
@@ -27,9 +27,11 @@
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
<%= render 'components/published-dates', {
diff --git a/app/views/content_items/consultation.html.erb b/app/views/content_items/consultation.html.erb
index 803f7cf69..812243dbe 100644
--- a/app/views/content_items/consultation.html.erb
+++ b/app/views/content_items/consultation.html.erb
@@ -25,7 +25,10 @@
<% if @content_item.opening_date_midnight? %>on<% else %>at<% end %>
<%= @content_item.opening_date %>
<% end %>
- <%= render 'govuk_publishing_components/components/notice', title: "This consultation isn't open yet", description_text: content_item_unopened %>
+ <%= render 'govuk_publishing_components/components/notice', {
+ title: "This consultation isn't open yet",
+ description_text: content_item_unopened,
+ } %>
<% elsif @content_item.pending_final_outcome? %>
<% content_item_final_outcome = capture do %>
@@ -47,9 +50,11 @@
<%= render 'govuk_publishing_components/components/heading', text: "Detail of outcome", mobile_top_margin: true %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.final_outcome_detail.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.final_outcome_detail) %>
+ <% end %>
<% end %>
@@ -59,18 +64,28 @@
attachments: @content_item.public_feedback_attachments %>
<% if @content_item.public_feedback_detail %>
- <%= render 'govuk_publishing_components/components/heading', text: "Detail of feedback received", mobile_top_margin: true %>
+ <%= render 'govuk_publishing_components/components/heading', {
+ mobile_top_margin: true,
+ text: "Detail of feedback received",
+ } %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.public_feedback_detail.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.public_feedback_detail) %>
+ <% end %>
<% end %>
<% if @content_item.final_outcome? %>
- <%= render 'govuk_publishing_components/components/heading', text: "Original consultation", id: "original-consultation-title", heading_level: 2, mobile_top_margin: true %>
+ <%= render 'govuk_publishing_components/components/heading', {
+ heading_level: 2,
+ id: "original-consultation-title",
+ mobile_top_margin: true,
+ text: "Original consultation",
+ } %>
<% end %>
@@ -92,11 +107,18 @@
<% consultation_desc = capture do %>
<%= @content_item.description %>
<% if @content_item.held_on_another_website? %>
-
- This consultation <% if @content_item.closed? %>was<% else %>is being<% end %> held on another website .
+
+
+ This consultation <% if @content_item.closed? %>was<% else %>is being<% end %> held on another website .
+
+
<% end %>
<% end %>
- <%= render 'components/banner', text: consultation_desc, title: 'Summary', aside: consultation_date %>
+ <%= render 'components/banner', {
+ aside: consultation_date,
+ text: consultation_desc,
+ title: 'Summary',
+ } %>
<% if @content_item.final_outcome? %>
@@ -104,8 +126,14 @@
- <%= render 'govuk_publishing_components/components/heading', text: "Consultation description", mobile_top_margin: true %>
- <%= render 'govuk_publishing_components/components/govspeak', @content_item.govspeak_body %>
+ <%= render 'govuk_publishing_components/components/heading', {
+ mobile_top_margin: true,
+ text: "Consultation description",
+ } %>
+
+ <%= render 'govuk_publishing_components/components/govspeak', {} do %>
+ <%= sanitize(@content_item.govspeak_body[:content]) %>
+ <% end %>
<%= render "attachments",
title: "Documents",
@@ -149,9 +177,11 @@
<% end %>
<% end %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @ways_to_respond_body,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@ways_to_respond_body) %>
+ <% end %>
<% end %>
diff --git a/app/views/content_items/corporate_information_page.html.erb b/app/views/content_items/corporate_information_page.html.erb
index c2ba3fe01..07150864e 100644
--- a/app/views/content_items/corporate_information_page.html.erb
+++ b/app/views/content_items/corporate_information_page.html.erb
@@ -47,7 +47,11 @@
<%= render "components/contents-list-with-body", contents: @content_item.contents do %>
- <%= render 'govuk_publishing_components/components/govspeak', content: "#{@content_item.body}#{@additional_body}".html_safe %>
+ <%= render 'govuk_publishing_components/components/govspeak', {} do %>
+ <%= sanitize("#{@content_item.body}#{@additional_body}", {
+ attributes: %w(id href),
+ }) %>
+ <% end %>
<% end %>
diff --git a/app/views/content_items/detailed_guide.html.erb b/app/views/content_items/detailed_guide.html.erb
index 4ef6ab5e3..9b418a019 100644
--- a/app/views/content_items/detailed_guide.html.erb
+++ b/app/views/content_items/detailed_guide.html.erb
@@ -28,7 +28,10 @@
margin_top: 0,
margin_bottom: 6,
} %>
- <%= render 'govuk_publishing_components/components/govspeak', @content_item.govspeak_body %>
+
+ <%= render 'govuk_publishing_components/components/govspeak', {} do %>
+ <%= sanitize(@content_item.govspeak_body[:content]) %>
+ <% end %>
<%= render 'components/published-dates', {
diff --git a/app/views/content_items/fatality_notice.html.erb b/app/views/content_items/fatality_notice.html.erb
index e8bd314b6..b635c6cbb 100644
--- a/app/views/content_items/fatality_notice.html.erb
+++ b/app/views/content_items/fatality_notice.html.erb
@@ -27,9 +27,11 @@
alt: @content_item.image["alt_text"],
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
<%= render 'components/published-dates', {
diff --git a/app/views/content_items/gone.html.erb b/app/views/content_items/gone.html.erb
index 5a65faced..e2eed2f17 100644
--- a/app/views/content_items/gone.html.erb
+++ b/app/views/content_items/gone.html.erb
@@ -1,12 +1,16 @@
- <%= render 'govuk_publishing_components/components/title', title: 'The page you\'re looking for is no longer available' %>
+ <%= render "govuk_publishing_components/components/title", {
+ title: "The page you're looking for is no longer available",
+ } %>
The information on this page has been removed because it was published in error.
- <%= render 'govuk_publishing_components/components/govspeak', content: raw(@content_item.explanation) %>
+ <%= render "govuk_publishing_components/components/govspeak", {} do %>
+ <%= sanitize(@content_item.explanation) %>
+ <% end %>
<% if @content_item.alternative_path.present? %>
diff --git a/app/views/content_items/guide.html.erb b/app/views/content_items/guide.html.erb
index 15ac15540..03433da2c 100644
--- a/app/views/content_items/guide.html.erb
+++ b/app/views/content_items/guide.html.erb
@@ -37,10 +37,12 @@
<% end %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.current_part_body.html_safe,
- direction: page_text_direction,
- disable_youtube_expansions: true %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ disable_youtube_expansions: true
+ } do %>
+ <%= sanitize(@content_item.current_part_body) %>
+ <% end %>
<% if @content_item.show_guide_navigation? %>
<%= render 'govuk_publishing_components/components/previous_and_next_navigation', @content_item.previous_and_next_navigation %>
diff --git a/app/views/content_items/html_publication.html.erb b/app/views/content_items/html_publication.html.erb
index 7e185ffd4..62db12ed6 100644
--- a/app/views/content_items/html_publication.html.erb
+++ b/app/views/content_items/html_publication.html.erb
@@ -57,7 +57,9 @@
- <%= render 'govuk_publishing_components/components/govspeak_html_publication', @content_item.govspeak_body %>
+ <%= render "govuk_publishing_components/components/govspeak_html_publication", {} do %>
+ <%= sanitize(@content_item.govspeak_body[:content]) %>
+ <% end %>
diff --git a/app/views/content_items/news_article.html.erb b/app/views/content_items/news_article.html.erb
index 89a82574b..e63ac69f3 100644
--- a/app/views/content_items/news_article.html.erb
+++ b/app/views/content_items/news_article.html.erb
@@ -26,9 +26,11 @@
alt: @content_item.image["alt_text"],
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
diff --git a/app/views/content_items/publication.html.erb b/app/views/content_items/publication.html.erb
index 100bed212..6318dd01e 100644
--- a/app/views/content_items/publication.html.erb
+++ b/app/views/content_items/publication.html.erb
@@ -36,13 +36,16 @@
- <%= render 'govuk_publishing_components/components/heading',
+ <%= render "govuk_publishing_components/components/heading", {
text: t("publication.details"),
- mobile_top_margin: true %>
-
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.details.html_safe,
- direction: page_text_direction %>
+ mobile_top_margin: true,
+ } %>
+
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.details) %>
+ <% end %>
diff --git a/app/views/content_items/service_sign_in/_choose_sign_in.html.erb b/app/views/content_items/service_sign_in/_choose_sign_in.html.erb
index 899de11ee..75d5d0f13 100644
--- a/app/views/content_items/service_sign_in/_choose_sign_in.html.erb
+++ b/app/views/content_items/service_sign_in/_choose_sign_in.html.erb
@@ -27,7 +27,9 @@
<%= render "govuk_publishing_components/components/fieldset", legend_text: legend_text do %>
- <%= render 'govuk_publishing_components/components/govspeak', content: raw(@content_item.description) %>
+ <%= render 'govuk_publishing_components/components/govspeak', {} do %>
+ <%= sanitize(@content_item.description) %>
+ <% end %>
<% if @error %>
<%= render "components/error-message", text: t('service_sign_in.error.option') %>
<% end %>
diff --git a/app/views/content_items/service_sign_in/_create_new_account.html.erb b/app/views/content_items/service_sign_in/_create_new_account.html.erb
index b909fe336..6286fca02 100644
--- a/app/views/content_items/service_sign_in/_create_new_account.html.erb
+++ b/app/views/content_items/service_sign_in/_create_new_account.html.erb
@@ -1,6 +1,8 @@
<%= render 'govuk_publishing_components/components/title', title: @content_item.title %>
- <%= render 'govuk_publishing_components/components/govspeak', content: @content_item.body.html_safe %>
+ <%= render 'govuk_publishing_components/components/govspeak', {} do %>
+ <% sanitize(@content_item.body) %>
+ <% end %>
diff --git a/app/views/content_items/specialist_document.html.erb b/app/views/content_items/specialist_document.html.erb
index aa433353c..a157e9feb 100644
--- a/app/views/content_items/specialist_document.html.erb
+++ b/app/views/content_items/specialist_document.html.erb
@@ -34,15 +34,17 @@
<% end %>
- <%= render 'govuk_publishing_components/components/govspeak', @content_item.govspeak_body %>
+ <%= render "govuk_publishing_components/components/govspeak", {} do %>
+ <%= sanitize(@content_item.govspeak_body[:content]) %>
+ <% end %>
+
<% if @content_item.continuation_link %>
- <%= render(
- 'govuk_publishing_components/components/button',
- start: true,
- href: @content_item.continuation_link,
- text: "Find out more",
- info_text: @content_item.will_continue_on
- ) %>
+ <%= render "govuk_publishing_components/components/button", {
+ href: @content_item.continuation_link,
+ info_text: @content_item.will_continue_on,
+ start: true,
+ text: "Find out more",
+ } %>
<% end %>
diff --git a/app/views/content_items/speech.html.erb b/app/views/content_items/speech.html.erb
index 27694c639..8ec42c1ab 100644
--- a/app/views/content_items/speech.html.erb
+++ b/app/views/content_items/speech.html.erb
@@ -30,9 +30,11 @@
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
<%= render 'components/published-dates', {
diff --git a/app/views/content_items/statistical_data_set.html.erb b/app/views/content_items/statistical_data_set.html.erb
index 9b54761ad..76619aec3 100644
--- a/app/views/content_items/statistical_data_set.html.erb
+++ b/app/views/content_items/statistical_data_set.html.erb
@@ -26,9 +26,12 @@
<%= render "components/contents-list-with-body", contents: @content_item.contents do %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ } do %>
+ <% sanitize(@content_item.body) %>
+ <% end %>
+
<%= render 'components/published-dates', {
diff --git a/app/views/content_items/take_part.html.erb b/app/views/content_items/take_part.html.erb
index adc415532..bbc288383 100644
--- a/app/views/content_items/take_part.html.erb
+++ b/app/views/content_items/take_part.html.erb
@@ -21,9 +21,11 @@
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
<%= render 'shared/sidebar_navigation' %>
diff --git a/app/views/content_items/topical_event_about_page.html.erb b/app/views/content_items/topical_event_about_page.html.erb
index a03bef7d5..ddc08ec47 100644
--- a/app/views/content_items/topical_event_about_page.html.erb
+++ b/app/views/content_items/topical_event_about_page.html.erb
@@ -17,9 +17,11 @@
<%= render "components/contents-list-with-body", {
contents: @content_item.contents,
} do %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render "govuk_publishing_components/components/govspeak", {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>
<% end %>
<%= render 'shared/sidebar_navigation' %>
diff --git a/app/views/content_items/travel_advice.html.erb b/app/views/content_items/travel_advice.html.erb
index c564f4950..9ea62940f 100644
--- a/app/views/content_items/travel_advice.html.erb
+++ b/app/views/content_items/travel_advice.html.erb
@@ -54,9 +54,11 @@
<%= render 'shared/travel_advice_summary', content_item: @content_item %>
<% end %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.current_part_body.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.current_part_body) %>
+ <% end %>
<%= render 'govuk_publishing_components/components/previous_and_next_navigation', @content_item.previous_and_next_navigation %>
diff --git a/app/views/content_items/unpublishing.html.erb b/app/views/content_items/unpublishing.html.erb
index d93b7862c..ec600973b 100644
--- a/app/views/content_items/unpublishing.html.erb
+++ b/app/views/content_items/unpublishing.html.erb
@@ -6,7 +6,9 @@
The information on this page has been removed because it was published in error.
- <%= render 'govuk_publishing_components/components/govspeak', content: raw(@content_item.explanation) %>
+ <%= render "govuk_publishing_components/components/govspeak", {} do %>
+ <%= sanitize(@content_item.explanation) %>
+ <% end %>
<% if @content_item.alternative_url.present? %>
diff --git a/app/views/content_items/working_group.html.erb b/app/views/content_items/working_group.html.erb
index 97c305bbe..2332285ff 100644
--- a/app/views/content_items/working_group.html.erb
+++ b/app/views/content_items/working_group.html.erb
@@ -28,9 +28,16 @@
<%= render 'govuk_publishing_components/components/lead_paragraph', text: @content_item.description %>
<%= render 'components/contents-list-with-body', contents: @content_item.contents do %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: "#{@content_item.body} #{@additional_body}".html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body, {
+ attributes: %w(id class href),
+ }) %>
+ <%= sanitize(@additional_body, {
+ attributes: %w(id class href),
+ }) %>
+ <% end %>
<% end %>
diff --git a/app/views/content_items/world_location_news_article.html.erb b/app/views/content_items/world_location_news_article.html.erb
index c5a93b0fa..ca20d3575 100644
--- a/app/views/content_items/world_location_news_article.html.erb
+++ b/app/views/content_items/world_location_news_article.html.erb
@@ -27,9 +27,11 @@
credit: @content_item.image["credit"],
caption: @content_item.image["caption"] if @content_item.image %>
- <%= render 'govuk_publishing_components/components/govspeak',
- content: @content_item.body.html_safe,
- direction: page_text_direction %>
+ <%= render 'govuk_publishing_components/components/govspeak', {
+ direction: page_text_direction,
+ } do %>
+ <%= sanitize(@content_item.body) %>
+ <% end %>