Merge branch '760-XSS-with-person-name' of https://github.com/Dorian/diaspora into Dorian-760-XSS-with-person-name

app/helpers/application_helper.rb

@@ -124,7 +124,7 @@ module ApplicationHelper
   end
 
   def person_image_tag(person, size=:thumb_small)
-    "<img alt='#{person.name}' class='avatar' data-person_id='#{person.id}' src='#{image_or_default(person, size)}' title='#{person.name}'>".html_safe
+    "<img alt=\"#{h(person.name)}\" class=\"avatar\" data-person_id=\"#{person.id}\" src=\"#{image_or_default(person, size)}\" title=\"#{h(person.name)}\">".html_safe
   end
 
   def person_link(person)

spec/helpers/application_helper_spec.rb

@@ -42,6 +42,14 @@ describe ApplicationHelper do
     end
   end
   
+  describe "#person_image_tag" do
+    it "should not allow basic XSS/HTML" do
+      @person.profile.first_name = "I'm <h1>Evil"
+      @person.profile.last_name = "I'm <h1>Evil"
+      person_image_tag(@person).should_not include("<h1>")
+    end
+  end
+
   describe "markdownify" do
     describe "autolinks" do
       it "should not allow basic XSS/HTML" do