Seeded text displayed raw HTML & unstyled backticks
Context: The format_learning_body
helper used sanitize: false
to preserve <strong>
tags, but this also allowed other raw HTML from the source text (like <input>
) to render. Backticks (`) were preserved but had no special styling.
Resolution: I modified the format_learning_body
helper:
1. Escape all HTML first (ERB::Util.html_escape
).
2. Bold keywords (<strong>
) on escaped string.
3. Wrap backticked content () with
<code>` tags on bolded string.
4. Apply simple_format(..., sanitize: false)
last.
5. Added CSS for code
tag.
Learning: When displaying potentially unsafe text that also needs specific safe HTML formatting, I learned the order matters: Escape first, then selectively add safe tags, then apply structural formatting (like simple_format
with sanitize: false
).
Learned on: April 20, 2024
Edit