Sanitize user fields, posts comments, and meta values against XSS attacks#4

Draft

texpert wants to merge 10 commits intomasterfrom

sanitize-user-fields-and-post-comments-against-xss

Commits on Feb 26, 2025

Sanitize user fields and posts comments against XSS attacks
texpert
committed
Slogan field is a meta, so don't sanitize it on user, but sanitize Meta's values
texpert
committed
Don't escape JSON string in `fix_meta_value`, we're sanitizing it in the model, so use JSON.generate(value), which is not escaping, instead of value.to_json, which is using ActiveSupport's escaping…
texpert
committed
Add capybara-lockstep gem to replace wait_for_ajax method
texpert
committed
Add capybara_lockstep to admin layout <head>
texpert
committed
Add Capybara::Lockstep::Middleware to config/environments/test of the Dummy app
texpert
committed
Add `:unhandled_prompt_behavior` option to Chrome drivers configurations to not automatically dismiss user prompts like alerts or modals. Also set increased `Capybara::Lockstep.timeout = 10` and `C…
texpert
committed
Replace spec_helper with `rails_helper` in the `.rspec` file, and remove redundant `rails_helper` from all the specs. Also add `RSpec.` to specs' `describe` to avoid polluting the common object-space.
texpert
committed
Add capybara-lockstep' to all the gemfiles
texpert
committed

Commits on Mar 11, 2025

Use value.to_json for ActionController::Parameters in `fix_meta_value`, because JSON.generate and fast_generate is escaping ActionController::Parameters
texpert
committed