Avoid potential XSS vulnerability in flash messages

app/controllers/admin/meetings_controller.rb

@@ -13,7 +13,7 @@ def create
     if @meeting.save
       redirect_to [:admin, @meeting], notice: t('admin.messages.meeting.created')
     else
-      flash[:notice] = @meeting.errors.full_messages.join('<br/>')
+      flash[:notice] = @meeting.errors.full_messages.join(', ')
       render :new
     end
   end
@@ -33,7 +33,7 @@ def update
     if @meeting.update(meeting_params)
       redirect_to [:admin, @meeting], notice: t('admin.messages.meeting.updated')
     else
-      flash[:notice] = @meeting.errors.full_messages.join('<br/>')
+      flash[:notice] = @meeting.errors.full_messages.join(', ')
       render 'edit'
     end
   end

app/models/meeting.rb

@@ -12,7 +12,7 @@ class Meeting < ApplicationRecord
   has_many :invitations, class_name: 'MeetingInvitation'
   has_and_belongs_to_many :chapters
 
-  validates :date_and_time, :ends_at, :venue, presence: true
+  validates :date_and_time, :ends_at, presence: true
   validates :slug, uniqueness: true, if: proc { |model| model.slug.present? }
 
   before_validation :set_date_and_time, :set_end_date_and_time

app/views/layouts/_messages.html.haml

@@ -3,11 +3,11 @@
     - name = name.eql?('notice') ? 'info' : name
     - if msg.is_a?(String)
       .alert.alert-dismissible.fade.show.mb-0{ 'data-alert': '', class: "alert-#{name}", role: 'alert' }
-        = content_tag :div, msg.html_safe
+        = content_tag :div, msg
         %button.btn-close{ type: 'button', 'data-bs-dismiss': 'alert', 'aria-label': 'Close' }
     - elsif msg.is_a?(Array)
       - msg.each do |message|
         .alert.alert-dismissible.fade.show.mb-0{ 'data-alert': '', class: "alert-#{name}", role: 'alert' }
-          = content_tag :span, message.html_safe
+          = content_tag :span, message
           %button.btn-close{ type: 'button', 'data-bs-dismiss': 'alert', 'aria-label': 'Close' }
 

spec/features/admin/meeting_spec.rb

@@ -31,7 +31,7 @@
 
       click_on 'Save'
 
-      expect(page).to have_content('Venue can\'t be blank')
+      expect(page).to have_content('Venue must be set')
     end
   end
 

spec/models/meeting_spec.rb

@@ -6,7 +6,7 @@
     subject(:meeting) { Fabricate(:meeting) }
     it { is_expected.to validate_presence_of(:date_and_time) }
     it { is_expected.to validate_presence_of(:ends_at) }
-    it { is_expected.to validate_presence_of(:venue) }
+    it { should belong_to(:venue) }
 
     context '#slug' do
       it 'fails when slug not present' do