added sanitizers to contributors page

first-timers[bot] commented 3 years ago

Hi, this is a first-timers-only issue. This means we've worked to make it more legible to folks who either haven't contributed to our codebase before, or even folks who haven't contributed to open source before.

If that's you, we're interested in helping you take the first step and can answer questions and help you out as you do. Note that we're especially interested in contributions from people from groups underrepresented in free and open source software!

We know that the process of creating a pull request is the biggest barrier for new contributors. This issue is for you 💝

If you have contributed before, consider leaving this one for someone new, and looking through our general help wanted issues. Thanks!

🤔 What you will need to know.

Nothing. This issue is meant to welcome you to Open Source :) We are happy to walk you through the process.

📋 Step by Step

[ ] 🙋 Claim this issue: Comment below. If someone else has claimed it, ask if they've opened a pull request already and if they're stuck -- maybe you can help them solve a problem or move it along!
[ ] 📝 Update the file app/views/tag/_contributors.html.erb in the plots2 repository (press the little pen Icon) and edit the line as shown below.

See this page for some help in taking your first steps!

Below is a "diff" showing in red (and a -) which lines to remove, and in green (and a +) which lines to add:

@@ -15,11 +15,11 @@
   <% if current_user && params["action"] == "contributors" %>
     <!-- AJAXify -->
     <div class="btn-group">
-      <a class="btn btn-outline-secondary btn-sm" href="/feed/tag/<%= params[:id] %>.rss"><i class="fa fa-rss"></i> RSS</a>
+      <a class="btn btn-outline-secondary btn-sm" href="/feed/tag/<%=h params[:id] %>.rss"><i class="fa fa-rss"></i> RSS</a>
       <% if current_user.following(params[:id]) %>
-        <a rel="tooltip" title="<%= translation('tag.contributors.unfollow',{},false) %>" class="btn btn-outline-secondary btn-sm" href="/unsubscribe/tag/<%= params[:id] %>"><i class="fa fa-user-plus" aria-hidden="true"></i> <%= translation('tag.contributors.following') %> <b><%= params[:id] %></b></a>
+        <a rel="tooltip" title="<%= translation('tag.contributors.unfollow',{},false) %>" class="btn btn-outline-secondary btn-sm" href="/unsubscribe/tag/<%=h params[:id] %>"><i class="fa fa-user-plus" aria-hidden="true"></i> <%= translation('tag.contributors.following') %> <b><%=h params[:id] %></b></a>
       <% else %>
-        <a class="btn btn-outline-secondary btn-sm" href="/subscribe/tag/<%= params[:id] %>"><i class="fa fa-user-plus" aria-hidden="true"></i> <%= translation('tag.contributors.follow') %> <b><%= params[:id] %></b></a>
+        <a class="btn btn-outline-secondary btn-sm" href="/subscribe/tag/<%= params[:id] %>"><i class="fa fa-user-plus" aria-hidden="true"></i> <%= translation('tag.contributors.follow') %> <b><%=h params[:id] %></b></a>
       <% end %>
       <a class="btn btn-outline-secondary btn-sm" rel="popover" data-placement="bottom" data-html="true" data-title="<%= translation('tag.show.users_following_tag',{},false) %>" data-content="<% Tag.followers(params[:id]).each do |user| %><i class='fa fa-star-o'></i> <a href='/profile/<%= user.username %>'><%= user.username %></a><br /><% end %><% if Tag.follower_count(params[:id]) == 0 %><i><%= translation('tag.show.none') %></i><% end %>"><%= Tag.follower_count(params[:id]) %> <i class="fa fa-user"></i> <span class="caret"></span></a>
     </div>
@@ -30,9 +30,9 @@
 <% end %>
 <br />
 <% if @wildcard %>
-  <p><%= raw translation('tag.contributors.wild_card_search_detected', :tag => params[:id]) %></p>
+  <p><%= raw translation('tag.contributors.wild_card_search_detected', tag: strip_tags(params[:id])) %></p>
 <% elsif @contributor_count.nil? || @contributor_count == 0 %>
-  <p><%= raw translation('tag.contributors.no_contributors', :tag => params[:id]) %></p>
+  <p><%= raw translation('tag.contributors.no_contributors', tag: strip_tags(params[:id])) %></p>
 <% else %>
   <div class="row">
     <div class="col-md-6">
@@ -45,7 +45,7 @@
           <% @users.each do |user| %>
             <tr class="users-row">
               <td><a href='/profile/<%= user.name %>'><i class="fa fa-user"></i> <%= user.name %></a></td>
-              <td><a href='/tag/<%= params[:id] %>/author/<%= user.name %>'><%= translation('tag.contributors.notes') %> &raquo;</a></td>
+              <td><a href='/tag/<%=h params[:id] %>/author/<%= user.name %>'><%= translation('tag.contributors.notes') %> &raquo;</a></td>
             </tr>
           <% end %>
         <% end %>

[ ] 💾 Commit your changes
[ ] 🔀 Start a Pull Request. There are two ways how you can start a pull request:
1. If you are not familiar with GitHub or the pull request model, here is a guide you can follow on how GitHub works.
2. If you are familiar with the terminal or would like to learn to use it, here is a great tutorial on how to send a pull request using the terminal.

You can also edit files directly in your browser and open a pull request from there.

[ ] 🏁 Done Ask in comments for a review :)

Please keep us updated

💬⏰ - We encourage contributors to be respectful to the community and provide an update within a week of claiming a first-timers-only issue. We're happy to keep it assigned to you as long as you need if you update us with a request for more time or help, but if we don't see any activity a week after you claim it we may reassign it to give someone else a chance. Thank you in advance!

If this happens to you, don't sweat it! Grab another open issue.

Is someone else already working on this?

🔗- We encourage contributors to link to the original issue in their pull request so all users can easily see if someone's already started on it.

👥- If someone seems stuck, offer them some help! Otherwise, take a look at some other issues you can help with. Thanks!

publiclab / plots2