1
95%
master: 95%

Ran 20 Jan 2026 06:28PM UTC

Files 342

Run time 10s

Badge

Embed ▾

Committed 20 Jan 2026 06:19PM UTC coverage: 95.04%. First build

Job # 21182606742.1

Build Type

push

github

Committed by

mroderick

Commit Message

Fix XSS vulnerability in event invitation emails

Replace `.html_safe` with `sanitize()` for event descriptions in email
templates to prevent potential XSS attacks while still allowing safe HTML
formatting tags.

Changes:
- Replace @event.description.html_safe with sanitize(@event.description)
  in invite_student.html.haml
- Replace @event.description.html_safe with sanitize(@event.description)
  in invite_coach.html.haml
- Add XSS protection test specs to verify dangerous tags are stripped
  while safe content is preserved

The sanitize helper uses Rails' built-in SafeListSanitizer which:
- Strips dangerous tags like <script> and event handlers (onclick, etc.)
- Allows safe HTML formatting tags (p, strong, em, a, br, etc.)
- Matches the pattern already used in non-email views throughout the codebase

Security: Fixes potential XSS vulnerability where malicious HTML/JavaScript
in event descriptions could be executed in invitation emails.

Run Details

6476 of 6814 relevant lines covered (95.04%)

40.22 hits per line

mroderick / codebar-planner / 21182606742 / 1
95%
master: 95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21182606742.1

mroderick / codebar-planner / 21182606742 / 1 95% master: 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21182606742.1

mroderick / codebar-planner / 21182606742 / 1
95%
master: 95%

README BADGES
x