Fix HTML injection for label description

Add changelog entry

Add spec

1 files changed, 6 insertions, 2 deletions

diff --git a/app/models/label.rb b/app/models/label.rb
index 25de26b8384..19f684c32af 100644
--- a/app/models/label.rb
+++ b/app/models/label.rb
@@ -197,7 +197,11 @@ class Label < ApplicationRecord
   end
 
   def title=(value)
-    write_attribute(:title, sanitize_title(value)) if value.present?
+    write_attribute(:title, sanitize_value(value)) if value.present?
+  end
+
+  def description=(value)
+    write_attribute(:description, sanitize_value(value)) if value.present?
   end
 
   ##
@@ -258,7 +262,7 @@ class Label < ApplicationRecord
     end
   end
 
-  def sanitize_title(value)
+  def sanitize_value(value)
     CGI.unescapeHTML(Sanitize.clean(value.to_s))
   end