Search code examples
ruby-on-railsrubyruby-on-rails-4brakeman

Unescaped model attribute

I have installed brakeman and getting security vulnerabilities.

Here is my warning

Unescaped model attribute rendered inline near line 24: render(inline => SendGridMailer.weekly_email([current_user], WeeklyNewsletterFactory.new.email(:preview => true)).html_part.body.raw_source, {})

Line:24

render inline: SendGridMailer.weekly_email([current_user], email).html_part.body.raw_source

I have tried this solution as suggested by brakeman but after doing this I start getting error Could not parse 

render(inline: SendGridMailer.weekly_email([current_user], email).html_part.body.raw_source,{})

Rails - 4.2.4
Brakeman - 3.1.2
Ruby - 2.3.1

Solution

  • You can make use of Premailer::Rails::Hook.perform

    Premailer::Rails::Hook.perform(SendGridMailer.weekly_email([current_user], email)).html_part.body.raw_source