Move html_safe declaration for user_mailer from layout to helper

This allows us to enable output safety checks for all code within
erb files.

`rubocop --auto-gen-config` ignores code within the erb files, so
it is easier to maintain an exclusion on the helper than inside
the layout.

diff --git a/.erb_lint.yml b/.erb_lint.yml
index 0c729d38f8426e5f564d2bb311ffb2f230b42b8f..dc9b39c5c5c7c94b991f1a287a37e62e1659d094 100644 (file)
--- a/.erb_lint.yml
+++ b/.erb_lint.yml
@@ -20,8 +20,6 @@ linters:
         Enabled: false
       Naming/FileName:
         Enabled: false
-      Rails/OutputSafety:
-        Enabled: false
       Style/FrozenStringLiteralComment:
         Enabled: false
   SelfClosingTag:

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 7384a8d95fee5c43c197b7abebd7767f95779702..0dd79ea2aefe33503668d07edb841ffc4a518e89 100644 (file)
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -169,6 +169,7 @@ Rails/NotNullColumn:
 Rails/OutputSafety:
   Exclude:
     - 'app/helpers/application_helper.rb'
+    - 'app/helpers/user_mailer_helper.rb'
     - 'lib/rich_text.rb'
     - 'test/helpers/application_helper_test.rb'
 

diff --git a/app/helpers/user_mailer_helper.rb b/app/helpers/user_mailer_helper.rb
index d47827074afd0c939facc643d5b246e5233df517..be756c212b943964caa0202b3b47e0347b3f8f7a 100644 (file)
--- a/app/helpers/user_mailer_helper.rb
+++ b/app/helpers/user_mailer_helper.rb
@@ -29,7 +29,7 @@ module UserMailerHelper
     # Because we can't use stylesheets in HTML emails, we need to inline the
     # styles. Rather than copy-paste the same string of CSS into every message,
     # we apply it once here, after the message has been composed.
-    html.gsub("<p>", '<p style="color: black; margin: 0.75em 0; font-family: \'Helvetica Neue\', Arial, Sans-Serif">')
+    html.gsub("<p>", '<p style="color: black; margin: 0.75em 0; font-family: \'Helvetica Neue\', Arial, Sans-Serif">').html_safe
   end
 
   def style_left

diff --git a/app/views/layouts/user_mailer.html.erb b/app/views/layouts/user_mailer.html.erb
index c10ed1c70f6d04352ea01fd137bb758f4635301d..7688ddb19cee5f086801108dd337ee11c2e6c00d 100644 (file)
--- a/app/views/layouts/user_mailer.html.erb
+++ b/app/views/layouts/user_mailer.html.erb
@@ -28,7 +28,7 @@
                 <table style="background-color: #fff; color: #222; border: solid 1px #ccc; border-collapse: separate">
                   <tr>
                     <td style="text-align: <%= style_left %>; padding: 0px 15px 5px 15px">
-                      <%= raw style_message(yield) %>
+                      <%= style_message(yield) %>
                     </td>
                   </tr>
                 </table>