Fix 32f91e4 broke fields with HTML tags

Refs. #3686 (comment), GHSA-8qgm-g2vv-vwvc

Author: mshibuya

.rubocop_todo.yml

@@ -21,7 +21,7 @@ Lint/ReturnInVoidContext:
 # Configuration parameters: CountComments, CountAsOne, ExcludedMethods, IgnoredMethods.
 # IgnoredMethods: refine
 Metrics/BlockLength:
- Max: 1107
+ Max: 1119
 
 # Offense count: 1
 # Configuration parameters: Max, CountKeywordArgs.

app/views/rails_admin/main/index.html.erb

@@ -133,9 +133,9 @@
  <% end %>
  <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
  <% value = property.pretty_value %>
- <td class="<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= value %>">
+ <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>
  <%= value %>
- </td>
+ <% end %>
  <% end %>
  <td class="last links ra-sidescroll-frozen">
  <ul class="nav d-inline list-inline">

spec/integration/actions/index_spec.rb

@@ -675,16 +675,29 @@
  expect(find('tbody tr:nth-child(1) td:nth-child(4)')).to have_content(@players.sort_by(&:id).collect(&:name).join(', '))
  end
 
- it 'does not allow XSS for title attribute' do
- RailsAdmin.config Team do
- list do
- field :name
+ describe 'with title attribute' do
+ it 'does not allow XSS' do
+ RailsAdmin.config Team do
+ list do
+ field :name
+ end
  end
+ @team = FactoryBot.create :team, name: '" onclick="alert()" "'
+ visit index_path(model_name: 'team')
+ expect(find('tbody tr:nth-child(1) td:nth-child(2)')['onclick']).to be_nil
+ expect(find('tbody tr:nth-child(1) td:nth-child(2)')['title']).to eq '" onclick="alert()" "'
+ end
+
+ it 'does not break values with HTML tags' do
+ RailsAdmin.config Player do
+ list do
+ field :team
+ end
+ end
+ @player = FactoryBot.create :player, team: FactoryBot.create(:team)
+ visit index_path(model_name: 'player')
+ expect(find('tbody tr:nth-child(1) td:nth-child(2)')['title']).to eq @player.team.name
  end
- @team = FactoryBot.create :team, name: '" onclick="alert()" "'
- visit index_path(model_name: 'team')
- expect(find('tbody tr:nth-child(1) td:nth-child(2)')['onclick']).to be_nil
- expect(find('tbody tr:nth-child(1) td:nth-child(2)')['title']).to eq '" onclick="alert()" "'
  end
  end