ADD: Comment HTML sanitization and tests for it

[VladimirMikulic]

This PR resolves 2 other PRs, they are closely related so I didn't want to separate them.

I've added HTML sanitization as explained in the comments.

   allowed_tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br...)

   # Sanitize the HTML (remove malicious attributes, unallowed tags...)
   sanitized_body = ActionController::Base.helpers.sanitize(body, tags: allowed_tags)

   # Properly parse HTML (close incomplete tags...)
   Nokogiri::HTML::DocumentFragment.parse(sanitized_body).to_html

There is no need to specify allowed attributes because .sanitize automatically strips malicious attributes.

Unit tests:

• "sanitizing comment body for XSS"
• "should close incomplete tags"

Demo

Resolves #3630 & #3553

[codecov]

Codecov Report

Merging #7282 into master will increase coverage by 0.04%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #7282      +/-   ##
==========================================
+ Coverage   81.56%   81.61%   +0.04%     
==========================================
  Files          97       97              
  Lines        5599     5601       +2     
==========================================
+ Hits         4567     4571       +4     
+ Misses       1032     1030       -2

Impacted Files	Coverage Δ
app/models/comment.rb	76.95% <100%> (+0.16%)	⬆️
app/controllers/users_controller.rb	81.69% <0%> (+0.35%)	⬆️
app/models/spamaway.rb	94.87% <0%> (+2.56%)	⬆️

[VladimirMikulic]

It's also nice to see that my optimization works. 9min 48secs system tests time.

[jywarren]

this is really well done! Thank you, @VladimirMikulic !! 🎉

[SidharthBansal]

Can you please get your system test 2 task approved and also claim system test 3 on GCI dashboard? Thanks all

…

On Sat, Jan 18, 2020 at 8:52 AM Jeffrey Warren ***@***.***> wrote: Merged #7282 <#7282> into master. — You are receiving this because your review was requested. Reply to this email directly, view it on GitHub <#7282?email_source=notifications&email_token=AFAAEQ6KFCR6ED7W6ASS7WLQ6JYYHA5CNFSM4KIMPNOKYY3PNVWWK3TUL52HS4DFWZEXG43VMVCXMZLOORHG65DJMZUWGYLUNFXW5KTDN5WW2ZLOORPWSZGOWBW3GEI#event-2959979281>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFAAEQ25S7WFSOTPCJVGXU3Q6JYYHANCNFSM4KIMPNOA> .