From aa2406e0f821e217ed5e0c59a212cecd73227509 Mon Sep 17 00:00:00 2001
From: David Eisner <david.eisner@oriel.oxon.org>
Date: Tue, 4 Oct 2016 16:27:40 +0100
Subject: Clean up Banzai HTML for HipChat

The `class` and `data-*` attributes are meaningless in HipChat, and it
would probably be better to limit the tags, too. For example, we could
avoid block-level elements in `render_line`.
---
 app/models/project_services/hipchat_service.rb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/app/models/project_services/hipchat_service.rb b/app/models/project_services/hipchat_service.rb
index ce4a2a96015..8988a7b905e 100644
--- a/app/models/project_services/hipchat_service.rb
+++ b/app/models/project_services/hipchat_service.rb
@@ -1,4 +1,6 @@
 class HipchatService < Service
+  include ActionView::Helpers::SanitizeHelper
+
   MAX_COMMITS = 3
 
   prop_accessor :token, :room, :server, :notify, :color, :api_version
@@ -138,6 +140,7 @@ class HipchatService < Service
 
       html = Banzai.render(text, context)
       html = Banzai.post_process(html, context)
+      sanitize html, attributes: %w(href title alt)
     else
       ""
     end
-- 
cgit v1.2.1