Merge branch 'pl-flash-toast' into 'master'

Unescape HTML in toast message

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/182453



Merged-by: Mark Florian <mflorian@gitlab.com>
Approved-by: Kevin Morrison <kmorrison@gitlab.com>
Approved-by: Michael Kozono <mkozono@gitlab.com>
Approved-by: Mark Florian <mflorian@gitlab.com>
Reviewed-by: Peter Leitzen <pleitzen@gitlab.com>
Reviewed-by: Mark Florian <mflorian@gitlab.com>
Reviewed-by: Michael Kozono <mkozono@gitlab.com>
Co-authored-by: Peter Leitzen <pleitzen@gitlab.com>

app/views/layouts/_flash.html.haml

@@ -7,7 +7,12 @@
 .flash-container.flash-container-page.sticky{ data: { testid: 'flash-container' }, class: flash_container_class }
   - flash.each do |key, value|
     - if key == 'toast' && value
-      .js-toast-message{ data: { message: value } }
+      -# Frontend renders toast messages as text and not as HTML.
+      -# Since toast messages are escaped on the backend via `safe_format` we
+      -# need to unescape to avoid double escaping HTML.
+      -# The spec spec/features/flash_messages_spec.rb ensures toasts always render plain text.
+      -# See https://gitlab.com/gitlab-org/gitlab/-/issues/520690
+      .js-toast-message{ data: { message: CGI.unescapeHTML(value) } }
     - elsif key == 'raw' && value
       = value
     - elsif value == I18n.t('devise.failure.unconfirmed')

spec/features/flash_messages_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe "Flash message", :js, feature_category: :design_system do
+  let_it_be(:user) { create(:user) }
+  let(:flash_text) { %q(it is <i>"HTML"</i> by 'design') }
+
+  # For convenience, we piggy back on existing controller so we don't need
+  # to tweak Rails routes.
+  let(:test_controller) do
+    Class.new(ApplicationController) do
+      include SafeFormatHelper
+
+      def kill
+        flash[params[:flash_type]] = safe_format(params[:flash_text])
+
+        render inline: 'rendering flash', layout: true # rubocop:disable Rails/RenderInline -- It's fine to render inline in specs.
+      end
+    end
+  end
+
+  subject(:request) { visit kill_chaos_path flash_type: flash_type, flash_text: flash_text }
+
+  before do
+    stub_const('ChaosController', test_controller)
+
+    sign_in(user)
+  end
+
+  describe 'notice' do
+    let(:flash_type) { :notice }
+
+    it 'renders flash as escaped HTML' do
+      request
+
+      expect(page.find('.gl-alert-info')).to have_content(flash_text)
+    end
+  end
+
+  describe 'toast' do
+    let(:flash_type) { :toast }
+
+    it 'renders flash as plain text' do
+      request
+
+      expect(page.find('[role="status"]')).to have_content(flash_text)
+    end
+  end
+end