SECURITY: Prefer Loofah for processing cooked HTML

lib/cooked_post_processor.rb

@@ -22,7 +22,7 @@ class CookedPostProcessor
     @cooking_options = @cooking_options.symbolize_keys
 
     cooked = post.cook(post.raw, @cooking_options)
-    @doc = Nokogiri::HTML5::fragment(cooked)
+    @doc = Loofah.fragment(cooked)
     @has_oneboxes = post.post_analyzer.found_oneboxes?
     @size_cache = {}
 

spec/components/cooked_post_processor_spec.rb

@@ -1809,4 +1809,12 @@ describe CookedPostProcessor do
     end
   end
 
+  context "#html" do
+    it "escapes attributes" do
+      post = Fabricate(:post, raw: '<img alt="<something>">')
+      expect(post.cook(post.raw)).to eq('<p><img alt="&lt;something&gt;"></p>')
+      expect(CookedPostProcessor.new(post).html).to eq('<p><img alt="&lt;something&gt;"></p>')
+    end
+  end
+
 end