Merge pull request rails#52281 from jagthedrummer/jeremy/action-text-content-trix-fix

ActionText::Content - Strip `content` attribute if it is empty

Author: rafaelfranca

actiontext/CHANGELOG.md

@@ -1,10 +1,13 @@
+*   Strip `content` attribute if the key is present but the value is empty
+
+    *Jeremy Green*
+
 *   Rename `rich_text_area` methods into `rich_textarea`
 
     Old names are still available as aliases.
 
     *Sean Doyle*
 
-
 *   Only sanitize `content` attribute when present in attachments.
 
     *Petrik de Heus*

actiontext/lib/action_text/content.rb

@@ -97,8 +97,9 @@ def append_attachables(attachables)
 
     def render_attachments(**options, &block)
       content = fragment.replace(ActionText::Attachment.tag_name) do |node|
-        if node.key? "content"
-          node["content"] = sanitize_content_attachment(node["content"])
+        if node.key?("content")
+          sanitized_content = sanitize_content_attachment(node.remove_attribute("content").to_s)
+          node["content"] = sanitized_content if sanitized_content.present?
         end
         block.call(attachment_for_node(node, **options))
       end

actiontext/test/unit/content_test.rb

@@ -164,6 +164,18 @@ class ActionText::ContentTest < ActiveSupport::TestCase
     assert_equal trix_html, content_from_html(html).to_trix_html.strip
   end
 
+  test "removes content attribute if it's value is empty" do
+    html = '<action-text-attachment sgid="123" content=""></action-text-attachment>'
+    trix_html = '<figure data-trix-attachment="{&quot;sgid&quot;:&quot;123&quot;}"></figure>'
+    assert_equal trix_html, content_from_html(html).to_trix_html.strip
+  end
+
+  test "removes content attribute if it's value is empty after sanitization" do
+    html = '<action-text-attachment sgid="123" content="<script></script>"></action-text-attachment>'
+    trix_html = '<figure data-trix-attachment="{&quot;sgid&quot;:&quot;123&quot;}"></figure>'
+    assert_equal trix_html, content_from_html(html).to_trix_html.strip
+  end
+
   test "does not add missing content attribute" do
     html = '<action-text-attachment sgid="123"></action-text-attachment>'
     trix_html = '<figure data-trix-attachment="{&quot;sgid&quot;:&quot;123&quot;}"></figure>'