Merge pull request #2152 from codidact/0valt/general-fixes

Safer subscription mailer view post body handling

Author: ArtOfCode-

app/mailers/subscription_mailer.rb

@@ -1,4 +1,5 @@
 class SubscriptionMailer < ApplicationMailer
+  helper PostsHelper
   helper UsersHelper
 
   def subscription

app/views/subscription_mailer/subscription.html.erb

@@ -15,8 +15,7 @@
     <%= link_to question.title, post_url(question, host: @subscription.community.host) %>
   </h3>
   <p>
-    <%= question.body.first(150).gsub(/<\/?[^>]+>/, '') %>
-    <%= question.body.length > 150 ? '...' : '' %>
+    <%= sanitize(strip_tags(question.body).truncate(150), scrubber: scrubber) %>
   </p>
   <p>
     &mdash; <%= user_link question.user, { host: @subscription.community.host }  %>

test/fixtures/posts.yml

@@ -621,3 +621,17 @@ without_new_thread_followers:
   community: sample
   category: main
   license: cc_by_sa
+
+with_sanitized_html:
+  post_type: question
+  title: This post contains HTML in body that is sanitized away
+  body: |
+    This is the body of the post used to test HTML sanitization
+    <del>oops</del>
+  body_markdown: |
+    <p>
+      This is the body of the post used to test HTML sanitization
+      <del>oops</del>
+    </p>
+  community: sample
+  user: standard_user

test/mailers/subscription_mailer_test.rb

@@ -1,7 +1,26 @@
 require 'test_helper'
 
 class SubscriptionMailerTest < ActionMailer::TestCase
-  # test "the truth" do
-  #   assert true
-  # end
+  test 'should correctly send subscription emails' do
+    all_sub = subscriptions(:all)
+    post_with_html = posts(:with_sanitized_html)
+
+    mailer = SubscriptionMailer.with(subscription: all_sub)
+    email = mailer.subscription
+
+    assert(all_sub.questions&.any? { |q| q.id == post_with_html.id })
+
+    assert_emails 1 do
+      email.deliver_later
+    end
+
+    assert email.from.include?(SiteSetting['SubscriptionSenderEmail'])
+    assert email.to.include?(all_sub.user.email)
+    assert email.subject.start_with?('Latest questions from your')
+
+    assert_dom_email do
+      assert_not_dom 'del'
+      assert_dom 'p', /oops/
+    end
+  end
 end