Prevent html injection on commits page by commit message

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

app/assets/stylesheets/sections/commits.scss

@@ -177,10 +177,18 @@ li.commit {
 
   .commit-row-description {
     font-size: 14px;
-    border-left: 1px solid #e5e5e5;
-    padding: 0 15px 0 7px;
+    border-left: 1px solid #EEE;
+    padding: 10px 15px;
     margin: 5px 0 10px 5px;
+    background: #f9f9f9;
     display: none;
+
+    pre {
+      border: none;
+      background: inherit;
+      padding: 0;
+      margin: 0;
+    }
   }
 
   .commit-row-info {

app/views/projects/commits/_commit.html.haml

@@ -22,7 +22,8 @@
 
   - if commit.description?
     .commit-row-description.js-toggle-content
-      = simple_format(commit.description)
+      %pre
+        = commit.description
 
   .commit-row-info
     = commit_author_link(commit, avatar: true, size: 16)