Problem with RailsSanitize.white_list_sanitizer.sanitize
Reported by sauce | July 23rd, 2008 @ 03:02 PM | in 2.x
Problem with RailsSanitize.white_list_sanitizer.sanitize.
Example :
RailsSanitize.white_list_sanitizer.sanitize("<a href=\"http://www.domain.com?var1=1&var2=2\">my link</a>") is OK and gives "<a href=\"http://www.domain.com?var1=1&var2=2\">my link</a>"
RailsSanitize.white_list_sanitizer.sanitize("<a href=\"http://www.domain.com?var1=1&var2=2\">my link</a>") is BAD and gives "<a href=\"http://www.domain.com?var1=1&amp;var2=2\">my link</a>"
As I sanitize each time I save my model, rails sanitize each time "&" so string is growing every time. (&amp;amp;amp;...)
Sorry for my english I am french !
Comments and changes to this ticket
-
antonmos August 27th, 2008 @ 07:50 PM
- → Tag changed from “” to “2.0-stable 2.1 patch sanitize”
This change set fixes this issue
-
Tietew September 2nd, 2008 @ 06:11 AM
It seems not to be fixed. CGI.unescape does not know much named entities and character references over U+FFFF.
gives
U+20000 is valid character.
In category "CJK Unified Ideographs Extension B"
GOOD result is:
or
or
-
Tietew September 2nd, 2008 @ 06:15 AM
Oops, tags are stripped...
It seems not to be fixed. CGI.unescape does not know much named entities and character references over U+FFFF.
<img alt="𠀀 is a «kanji»" ...> gives <img alt="&#131072; is a &laquo;kanji&raquo;" ...># U+20000 is valid character. # In category "CJK Unified Ideographs Extension B"
GOOD result is: <img alt="𠀀 is a «kanji»" ...> or <img alt="𠀀 is a «kanji»" ...> or <img alt="? is a «kanji»" ...> -
Ryan McGeary October 17th, 2008 @ 03:41 AM
+1 on antonmos's changes. Here's a formatted patch that incorporates the changes to comply with the Rails contribution guidelines.
-
Christopher Murphy October 17th, 2008 @ 03:55 AM
- This bug has burned me in my app.
Patch works, tests passed.
-
-
-
theflow November 6th, 2008 @ 11:17 AM
+1
Patch works great for me. The problem Tietew mentions is a general problem with sanitize and not caused by the proposed patch.
Any chance to get this into 2.2?
-
Repository November 6th, 2008 @ 12:09 PM
- → State changed from “new” to “committed”
(from [a358d87e16fa876de29286b69474ab6aaee4a80b]) Fixed the sanitize helper to avoid double escaping already properly escaped entities [#683 state:committed] http://github.com/rails/rails/co...
-
Repository November 6th, 2008 @ 12:09 PM
(from [6406a87eedb74a41f19f5ad21ea1b8f97dd45755]) Fixed the sanitize helper to avoid double escaping already properly escaped entities [#683 state:committed] http://github.com/rails/rails/co...
-
iGEL November 14th, 2008 @ 03:15 PM
Sorry, I havn't tried it yet, but it sounds like a bad idea. Maybe as an option, disabled by default.
But what, if the user wants to write & or ä as a comment? As far as I understand, Rails will now ignore these entities and it will be displayed as & or ä.
-
iGEL November 14th, 2008 @ 03:20 PM
If you want a demonstration of the problem, look above. Of course I wanted to write & a m p ; and & a u m l; without spaces (I try double escaping: & ä). What the user enters should be displayed, he shouldn't care about entities and everything...
-
Ryan McGeary November 14th, 2008 @ 03:32 PM
iGEL, I disagree. The purpose of the sanitize method is to sanitize HTML input. The ampersand entities are valid HTML. When displayed, they should display the entities they represent, not the literal codes.
In other words, you should expect [& a m p ;] to be displayed as an ampersand. Just like an html tag shouldn't be escaped to it's lt and gt entities, entities themselves should not be escaped either.
Please Login or create a free account to add a new comment.
You can update this ticket by sending an email to from your email client. (help)
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
Source available from github
Repository is at http://github.com/rails/rails
Check out the development master (Edge Rails):
git clone git://github.com/rails/rails.git
Creating or reviewing a patch
See the contributor guide.
Creating a feature request
Please don't. If you want a new feature in Rails, you'll have to pull up your sleeves and get busy yourself. Or convince someone else to do it. See the contributor guide on how to get going. But posting them here is just going to lead to ticket root.
Creating a bug report
When creating a bug report, be sure to include as much relevant information as possible. Post the code sample that causes the problem. Preferably, alter the unit tests and show through either changed or added tests how the expected behavior is not occuring.
Security vulnerabilities should be reported via an email to security@rubyonrails.org, do not use trac for reporting security vulnerabilities. All content in trac is publicly available as soon as it is posted.
Then don't get your hopes up. Unless you have a "Code Red, Mission Critical, The World is Coming to an End" kinda bug, you're creating this ticket in the hope that others with the same problem will be able to collaborate with you on solving it. Do not expect that the ticket automatically will see any activity or that others will jump to fix it. Creating a ticket like this is mostly to help yourself start on the path of fixing the problem and for others to sign on to with a "I'm having this problem too"..
Daniel Holmlund