Let tables through the message sanitizers

Lexxy imports pasted and Markdown tables, and the tag sanitizer dropped
them with everything in them on render.
This commit is contained in:
Stanko K.R.
2026-09-26 10:04:38 +02:00
parent 8bdff5ddc6
commit 1694accbf8
3 changed files with 14 additions and 4 deletions
+1 -1
View File
@@ -6,7 +6,7 @@ module ContentFilters
# * SanitizeTags strips disallowed markup from the message body
# * Action Text sanitizes the rendered content (lib/rails_ext/action_text_allowed_tags.rb)
# * auto_link re-sanitizes the final html (MessagesHelper#message_presentation)
EDITOR_FORMATTING_TAGS = %w[ s u mark ]
EDITOR_FORMATTING_TAGS = %w[ s u mark table thead tbody tfoot tr th td ]
EDITOR_FORMATTING_ATTRIBUTES = %w[ data-language ]
TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, SanitizeTags, SanitizeAttributes)
+10
View File
@@ -158,6 +158,16 @@ class ContentFiltersTest < ActionView::TestCase
assert_match /<action-text-attachment sgid="#{users(:david).attachable_sgid}"/, filtered
end
test "message with a table keeps the table" do
body = "<figure class=\"lexxy-content__table-wrapper\"><table><tbody><tr><th><p>Name</p></th></tr><tr><td><p>Jason</p></td></tr></tbody></table></figure>"
message = Message.create! room: rooms(:pets), body: body, client_message_id: "0016", creator: users(:jason)
filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body).to_html
assert_equal body, filtered
assert_match %r{<table>.*<th><p>Name</p></th>.*<td><p>Jason</p></td>}m, message_presentation(message)
end
test "message with a mention attachment" do
message = Message.create! room: rooms(:pets), body: "<div>Hey #{mention_attachment_for(:david)}</div>", creator: users(:jason)
+3 -3
View File
@@ -103,15 +103,15 @@ class ComposerTest < ApplicationSystemTestCase
assert_equal [ users(:jason) ], message.reload.mentionees
end
test "pasting a table keeps its text" do
test "pasting a table sends it as a table" do
paste_in_composer "Name Points\nJason 10", html: "<table><tr><th>Name</th><th>Points</th></tr><tr><td>Jason</td><td>10</td></tr></table>"
assert_selector "#composer lexxy-editor table"
click_send_button
assert_message_text /Name Points\s*Jason 10/
assert_no_selector last_message_selector("table")
assert_selector last_message_selector("table th"), text: "Name"
assert_selector last_message_selector("table td"), text: "10"
end
test "replying quotes the original message with attribution" do