Fix escape characters in categories

lib/extends/helpers/decidim/check_boxes_tree_helper_extends.rb

@@ -1,6 +1,33 @@
 # frozen_string_literal: true
 
 module CheckBoxesTreeHelperExtends
+
+  def filter_categories_values
+    sorted_main_categories = current_participatory_space.categories.first_class.includes(:subcategories).sort_by do |category|
+      [category.weight, translated_attribute(category.name)]
+    end
+
+    categories_values = sorted_main_categories.flat_map do |category|
+      sorted_descendant_categories = category.descendants.includes(:subcategories).sort_by do |subcategory|
+        [subcategory.weight, translated_attribute(subcategory.name)]
+      end
+
+      subcategories = sorted_descendant_categories.flat_map do |subcategory|
+        Decidim::CheckBoxesTreeHelper::TreePoint.new(subcategory.id.to_s, translated_attribute(subcategory.name))
+      end
+
+      Decidim::CheckBoxesTreeHelper::TreeNode.new(
+        Decidim::CheckBoxesTreeHelper::TreePoint.new(category.id.to_s, translated_attribute(category.name)),
+        subcategories
+      )
+    end
+
+    Decidim::CheckBoxesTreeHelper::TreeNode.new(
+      Decidim::CheckBoxesTreeHelper::TreePoint.new("", t("decidim.core.application_helper.filter_category_values.all")),
+      categories_values
+    )
+  end
+
   def filter_scopes_values
     return filter_scopes_values_from_parent(current_component.scope) if current_component.scope.present?
 

spec/helpers/check_boxes_tree_helper_spec.rb

@@ -20,6 +20,36 @@ module Decidim
       allow(helper).to receive(:current_component).and_return(component)
     end
 
+    describe "#filter_categories_values" do
+      let(:root) { helper.filter_categories_values }
+      let(:leaf) { helper.filter_categories_values.leaf }
+      let(:nodes) { helper.filter_categories_values.node }
+
+      context "when the participatory space does not have categories" do
+        it "does not return any category" do
+          expect(leaf.value).to eq("")
+          expect(nodes.count).to eq(0)
+          expect(nodes.first).to be_nil
+        end
+      end
+
+      context "when the participatory space has a category with subcategories" do
+        let(:participatory_space) { create(:participatory_process, organization:) }
+        let(:category) { create(:category, participatory_space:) }
+        let!(:subcategories) { create_list(:subcategory, 5, parent: category, participatory_space:) }
+
+        it "returns all the subcategories" do
+          expect(leaf.value).to eq("")
+          expect(root).to be_a(Decidim::CheckBoxesTreeHelper::TreeNode)
+          expect(root.node.first.node.count).to eq(5)
+        end
+
+        it "does not sanitize the labels" do
+          expect(root.node.first.first.label).to start_with("<script>alert(\"category_name\");</script>")
+        end
+      end
+    end
+
     describe "#filter_scopes_values" do
       let(:root) { helper.filter_scopes_values }
       let(:leaf) { helper.filter_scopes_values.leaf }