This project is archived and is in readonly mode.
text_area_tag should escape contents by default
Reported by Chris Mear | February 19th, 2009 @ 02:20 PM | in 2.3.4
text_area_tag currently does not HTML-escape its contents/value by default. However, the rest of the form tag helpers do escape their values, and the corresponding text_area method in FormHelper does it as well.
For consistency and security's sake, it seems like text_area_tag should escape its content by default too.
See also discussion here:
http://groups.google.com/group/r...
and previous ticket here:
http://dev.rubyonrails.org/ticke...
Simple patch attached.
Comments and changes to this ticket
-
-
Pratik June 21st, 2009 @ 05:20 PM
- Assigned user set to “Michael Koziarski”
Koz is the master of escaping.
-
-
Michael Koziarski June 26th, 2009 @ 06:07 AM
- Milestone changed from “2.x” to “2.3.4”
Looks good, but the patch doesn't apply cleanly now.
Can you address that (with perhaps a patch each for master and 2-3-stable) and I'll get it in.
-
Michael Koziarski June 26th, 2009 @ 06:10 AM
Looks good to me.
This patch no longer cleanly applies, but if you can address that I'll
get it in for 2-3 and master. -
Chris Mear June 26th, 2009 @ 11:51 AM
Here's two new patches, one that applies to the current master branch, and one for the 2-3-stable branch.
-
Repository June 27th, 2009 @ 02:17 AM
- State changed from “new” to “committed”
(from [085db5e128ad4ad8fd042776722c78e194c6d0a4]) Make text_area_tag escape contents by default.
Signed-off-by: Michael Koziarski michael@koziarski.com
[#2015 state:committed] http://github.com/rails/rails/commit/085db5e128ad4ad8fd042776722c78... -
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
People watching this ticket
Chris Mear
Michael Koziarski
Pratik
Attachments
Referenced by
-
2015
text_area_tag should escape contents by default
Signed-off-by: Michael Koziarski
michael@koziarski.com
[#...