Refactor test for user detail sanitization
What does this MR do and why?
Refactors the UserDetail model's sanitize_attrs method and its corresponding tests for improved code organization and maintainability.
Key changes:
-
Move
sanitize_attrsto private section: The method was previously declared as public but is only called internally viabefore_validationcallback. Moving it to the private section better reflects its intended usage. -
Refactor tests to use parameterized table syntax: The
#sanitize_attrsdescribe block inspec/models/user_detail_spec.rbhas been refactored from shared examples with loops to use RSpec's parameterized table syntax (where/with_them), making the tests more readable and easier to extend.
Behavioral changes:
None. This is a pure refactoring with no changes to runtime behavior. The sanitization logic remains exactly the same:
- HTML tags are stripped from all fields
- Script and iframe elements are removed
- Ampersands (
&) are encoded to&forlinkedin,twitter, andwebsite_urlfields - Ampersands are preserved (not encoded) for
locationandorganizationfields
References
- Related to issue #577060 (closed)
- Sanitizable concern:
app/models/concerns/sanitizable.rb
Screenshots or screen recordings
N/A - Backend refactoring with no UI changes
How to set up and validate locally
-
Run the test suite to verify the refactored tests pass:
bundle exec rspec spec/models/user_detail_spec.rb -e "sanitize_attrs" -
Verify sanitization still works correctly in Rails console:
user = User.first ud = user.user_detail # HTML tags should be stripped ud.linkedin = '<script>alert("xss")</script>test' ud.save ud.linkedin # Should output: 'test' # Ampersand handling for linkedin/twitter/website_url (encodes) ud.twitter = 'test&value' ud.save ud.twitter # Should output: 'test&value' # Ampersand handling for location/organization (preserves) ud.location = 'San Francisco & Bay Area' ud.save ud.location # Should output: 'San Francisco & Bay Area'
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
-
Changelog entry added, if necessary -
Documentation created/updated via this MR -
Tests added for this feature/bug - Tests refactored using parameterized table syntax -
Conforms to the code review guidelines -
Conforms to the style guides -
All RSpec tests pass -
RuboCop linting passes with no offenses -
No database migrations required (model-only changes)