Sanitize user attrs on model level

Gemfile

@@ -118,6 +118,9 @@ gem "d3_rails", "~> 3.1.4"
 # underscore-rails
 gem "underscore-rails", "~> 1.4.4"
 
+# Sanitize user input
+gem "sanitize"
+
 group :assets do
   gem "sass-rails"
   gem "coffee-rails"

Gemfile.lock

@@ -610,6 +610,7 @@ DEPENDENCIES
   redcarpet (~> 2.2.2)
   redis-rails
   rspec-rails
+  sanitize
   sass-rails
   sdoc
   seed-fu

app/controllers/profiles_controller.rb

@@ -17,7 +17,7 @@ class ProfilesController < ApplicationController
   end
 
   def update
-    if @user.update_attributes(user_attributes)
+    if @user.update_attributes(params[:user])
       flash[:notice] = "Profile was successfully updated"
     else
       flash[:alert] = "Failed to update profile"
@@ -69,19 +69,6 @@ class ProfilesController < ApplicationController
     @user = current_user
   end
 
-  def user_attributes
-    user_attributes = params[:user]
-
-    # Sanitize user input because we dont have strict
-    # validation for this fields
-    %w(name skype linkedin twitter bio).each do |attr|
-      value = user_attributes[attr]
-      user_attributes[attr] = sanitize(strip_tags(value)) if value.present?
-    end
-
-    user_attributes
-  end
-
   def authorize_change_password!
     return render_404 if @user.ldap_user?
   end

app/models/user.rb

@@ -114,7 +114,10 @@ class User < ActiveRecord::Base
   validate :namespace_uniq, if: ->(user) { user.username_changed? }
 
   before_validation :generate_password, on: :create
+  before_validation :sanitize_attrs
+
   before_save :ensure_authentication_token
+
   alias_attribute :private_token, :authentication_token
 
   delegate :path, to: :namespace, allow_nil: true, prefix: true
@@ -356,4 +359,11 @@ class User < ActiveRecord::Base
   def created_by
     User.find_by_id(created_by_id) if created_by_id
   end
+
+  def sanitize_attrs
+    %w(name username skype linkedin twitter bio).each do |attr|
+      value = self.send(attr)
+      self.send("#{attr}=", Sanitize.clean(value)) if value.present?
+    end
+  end
 end