Exclude Details elements from HTML sanitization for inline attachments

Gemfile.lock

@@ -221,7 +221,7 @@ GEM
       activemodel (>= 4.2, < 7.0)
       activerecord (>= 4.2, < 7.0)
       request_store (~> 1.0)
-    govspeak (6.5.10)
+    govspeak (6.6.0)
       actionview (>= 5.0, < 7)
       addressable (>= 2.3.8, < 3)
       govuk_publishing_components (>= 23)
@@ -372,7 +372,7 @@ GEM
     nokogiri (1.11.0)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
-    nokogumbo (2.0.2)
+    nokogumbo (2.0.4)
       nokogiri (~> 1.8, >= 1.8.4)
     notifications-ruby-client (5.1.2)
       jwt (>= 1.5, < 3)
@@ -526,7 +526,7 @@ GEM
     rufus-scheduler (3.6.0)
       fugit (~> 1.1, >= 1.1.6)
     safe_yaml (1.0.5)
-    sanitize (5.2.1)
+    sanitize (5.2.3)
       crass (~> 1.0.2)
       nokogiri (>= 1.8.0)
       nokogumbo (~> 2.0)

app/helpers/govspeak_helper.rb

@@ -25,8 +25,9 @@ def govspeak_with_attachments_to_html(body, attachments = [], alternative_format
 
   def bare_govspeak_edition_to_html(edition)
     images = edition.respond_to?(:images) ? edition.images : []
+    allowed_elements = edition.allows_inline_attachments? ? %w[details] : []
     partially_processed_govspeak = edition_body_with_attachments_and_alt_format_information(edition)
-    bare_govspeak_to_html(partially_processed_govspeak, images)
+    bare_govspeak_to_html(partially_processed_govspeak, images, allowed_elements: allowed_elements)
   end
 
   def bare_govspeak_with_attachments_to_html(body, attachments = [], alternative_format_contact_email = nil)
@@ -109,7 +110,7 @@ def bare_govspeak_to_html(govspeak, images = [], options = {}, &block)
     govspeak = set_classes_for_charts(govspeak)
     govspeak = set_classes_for_sortable_tables(govspeak)
 
-    markup_to_nokogiri_doc(govspeak, images)
+    markup_to_nokogiri_doc(govspeak, images, options[:allowed_elements])
       .tap { |nokogiri_doc|
         # post-processors
         replace_internal_admin_links_in(nokogiri_doc, &block)
@@ -235,8 +236,8 @@ def extract_number_from_heading(nokogiri_el)
     nokogiri_el.inner_text[/^\d+.?[^\s]*/]
   end
 
-  def markup_to_nokogiri_doc(govspeak, images = [])
-    govspeak = build_govspeak_document(govspeak, images)
+  def markup_to_nokogiri_doc(govspeak, images = [], allowed_elements = [])
+    govspeak = build_govspeak_document(govspeak, images, allowed_elements)
     doc = Nokogiri::HTML::Document.new
     doc.encoding = "UTF-8"
     doc.fragment(govspeak.to_html)
@@ -264,9 +265,9 @@ def edition_body_with_attachments_and_alt_format_information(edition)
     govspeak_with_attachments_and_alt_format_information(edition.body, attachments, edition.alternative_format_contact_email)
   end
 
-  def build_govspeak_document(govspeak, images = [])
+  def build_govspeak_document(govspeak, images = [], allowed_elements = [])
     hosts = [Whitehall.admin_host, Whitehall.public_host]
-    Govspeak::Document.new(govspeak, document_domains: hosts).tap do |document|
+    Govspeak::Document.new(govspeak, { document_domains: hosts, allowed_elements: allowed_elements }).tap do |document|
       document.images = images
     end
   end

test/unit/helpers/govspeak_helper_test.rb

@@ -479,4 +479,26 @@ class GovspeakHelperTest < ActionView::TestCase
     html = govspeak_with_attachments_to_html(body, attachments, "[email protected]")
     assert html.include? ">[email protected]</a>"
   end
+
+  test "should not sanitise Details element for Editions that allow inline attachments" do
+    text = "#Heading\n\n!@1\n\n##Subheading."
+    document = build(
+      :published_detailed_guide,
+      :with_file_attachment,
+      body: text,
+      attachments: [build(:file_attachment, id: 1)],
+    )
+    html = govspeak_edition_to_html(document)
+    assert html.include?("<details class=\"gem-c-details")
+  end
+
+  test "should sanitise Details for Editions that do not allow inline attachments " do
+    text = "#Heading\n\n!@1\n\n##Subheading"
+    document = build(
+      :consultation_with_outcome_file_attachment,
+      body: text,
+    )
+    html = govspeak_edition_to_html(document)
+    assert_not html.include?("<details class=\"gem-c-details")
+  end
 end