SECURITY: Stripping links could unescape html fragments

lib/pretty_text.rb

@@ -250,7 +250,7 @@ module PrettyText
 
     # If the user is not basic, strip links from their bio
     fragment = Nokogiri::HTML.fragment(string)
-    fragment.css('a').each {|a| a.replace(a.text) }
+    fragment.css('a').each {|a| a.replace(a.inner_html) }
     fragment.to_html
   end
 

spec/components/pretty_text_spec.rb

@@ -218,6 +218,10 @@ describe PrettyText do
     it "strips links but leaves the text content" do
       expect(PrettyText.strip_links("I'm the linked <a href='http://en.wikipedia.org/wiki/Batman'>batman</a>")).to eq("I'm the linked batman")
     end
+
+    it "escapes the text content" do
+      expect(PrettyText.strip_links("I'm the linked <a href='http://en.wikipedia.org/wiki/Batman'>&lt;batman&gt;</a>")).to eq("I'm the linked &lt;batman&gt;")
+    end
   end
 
   describe "make_all_links_absolute" do