Show a session's reason as text

app/helpers/audits1984/application_helper.rb

@@ -40,6 +40,12 @@ def highlight_code(source)
       formatter.format(lexer.lex(source)).html_safe
     end
 
+    # Text a console user typed, such as a session's reason or a sensitive access's
+    # justification, shown as text with its URLs linked.
+    def text_with_links(text)
+      Rinku.auto_link(h(text.to_s)).html_safe
+    end
+
     def sensitive_session_decoration(session)
       "*" if session.sensitive?
     end

app/views/audits1984/sessions/_executed_code.html.erb

@@ -9,7 +9,7 @@
         <div class="media-content">
           <% if sensitive_access %>
             <p class="title is-4">Sensitive access *</p>
-            <p class="subtitle is-6"><%= Rinku.auto_link(sensitive_access.justification).html_safe %></p>
+            <p class="subtitle is-6"><%= text_with_links(sensitive_access.justification) %></p>
           <% else %>
             <p class="title is-4">Protected access</p>
           <% end %>

app/views/audits1984/sessions/_header.html.erb

@@ -1,4 +1,4 @@
-<h2 class="title"><%= Rinku.auto_link(session.reason).html_safe %> <%= sensitive_session_decoration(session) %></h2>
+<h2 class="title"><%= text_with_links(session.reason) %> <%= sensitive_session_decoration(session) %></h2>
 <h3 class="subtitle">by <%= session.user.username %>
   <br> <%= format_date_and_time(session.created_at) %></h3>
 

test/integration/session_text_test.rb

@@ -0,0 +1,38 @@
+require "test_helper"
+
+class SessionTextTest < ActionDispatch::IntegrationTest
+  setup do
+    Auditor.find_or_create_by!(name: "Jorge")
+
+    @session = Console1984::Session.create! user: Console1984::User.first,
+      reason: %(<img src="x" onerror="alert(1)"> see https://example.com/cards/1?a=1&b=2)
+    sensitive_access = @session.sensitive_accesses.create! justification: %(<b onclick="x()">consent</b> https://example.com/conversations/2)
+    @session.commands.create! statements: %(puts "<i>#{"hello"}</i>"), sensitive_access: sensitive_access
+  end
+
+  test "shows a session's reason as text, with its links" do
+    get "/sessions/#{@session.id}"
+
+    assert_response :success
+    assert_select "h2.title img", 0
+    assert_select "h2.title", text: /<img src="x" onerror="alert\(1\)"> see/
+    assert_select "h2.title a[href=?]", "https://example.com/cards/1?a=1&b=2", text: "https://example.com/cards/1?a=1&b=2"
+  end
+
+  test "shows a sensitive access's justification as text, with its links" do
+    get "/sessions/#{@session.id}"
+
+    assert_response :success
+    assert_select ".card p.subtitle b", 0
+    assert_select ".card p.subtitle", text: /<b onclick="x\(\)">consent<\/b>/
+    assert_select ".card p.subtitle a[href=?]", "https://example.com/conversations/2"
+  end
+
+  test "shows executed code as text" do
+    get "/sessions/#{@session.id}"
+
+    assert_response :success
+    assert_select "pre.highlight i", 0
+    assert_select "pre.highlight", text: /<i>/
+  end
+end