From e65225721730c2a8ab26bac9d2793cf0ec6b08cd Mon Sep 17 00:00:00 2001 From: rrader2890 Date: Tue, 16 Jun 2026 19:22:56 -0400 Subject: [PATCH] chore(white-label): satisfy rubocop on the MSA gate controller Disable Rails/ApplicationController (ApplicationController is ActionController::API and cannot render HTML) and Rails/OutputSafety (markup is trusted; all interpolated values are escaped via ERB::Util.html_escape) for this controller, and switch two continuation strings to double quotes. Co-Authored-By: Claude Opus 4.8 (1M context) --- app/controllers/white_label_controller.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/app/controllers/white_label_controller.rb b/app/controllers/white_label_controller.rb index e0a7bcb044ce..243f39ff24a2 100644 --- a/app/controllers/white_label_controller.rb +++ b/app/controllers/white_label_controller.rb @@ -12,6 +12,11 @@ # After the signer saves a card on Stripe, the `setup_intent.succeeded` webhook # calls WhiteLabel::ActivateService, which creates the subscription. So this # controller never touches billing directly — it only captures consent + a card. +# +# ApplicationController is ActionController::API (no HTML rendering) and every +# interpolated value is escaped via ERB::Util.html_escape, so the two Rails cops +# below are intentionally disabled for this trusted-markup controller. +# rubocop:disable Rails/ApplicationController, Rails/OutputSafety class WhiteLabelController < ActionController::Base skip_forgery_protection @@ -89,15 +94,16 @@ def render_status(agreement) def render_accepted_without_card body = '

Thank you

Your acceptance has been recorded. ' \ - 'We will email you a secure link to add your payment method shortly.

' + "We will email you a secure link to add your payment method shortly.

" render html: layout(body).html_safe end def render_invalid render html: layout('

Link expired or invalid

This acceptance ' \ - 'link is no longer valid. Please contact your Flobyte representative for a new link.

').html_safe, + "link is no longer valid. Please contact your Flobyte representative for a new link.

").html_safe, status: :not_found end + # rubocop:enable Rails/ApplicationController, Rails/OutputSafety # Read a versioned legal doc, stripping the leading HTML comment header. def doc_body(kind, version)