#3559 Problem with XSS escape in select_* (eg: select_month) helpers - Ruby on Rails

Type	To find
responsible:me	tickets assigned to you
tagged:"@high"	tickets tagged @high
milestone:next	tickets in the upcoming milestone
state:invalid	tickets with the state invalid
created:"last week"	tickets created last week
sort:number, importance, updated	tickets sorted by #, importance or updated
Combine keywords for powerful searching.
Use advanced searching »

This project is archived and is in readonly mode.

#3559 ✓stale

Problem with XSS escape in select_* (eg: select_month) helpers

Reported by Daniel Lopes | December 10th, 2009 @ 09:25 PM | in 2.3.10

I just tested the new Rails 2.3.5 with rails_xss plugin and it fail in select_* helpers. For now I just tested in select_month, select_year and select_day but probably this behavior is the same in select_seconds and select_minutes.

The problem is rails_xss doesn't work like other xss proof helper, and escape the options and select html tags generated by these helpers.

Comments and changes to this ticket

Michael Koziarski December 11th, 2009 @ 12:24 AM
- Tag set to “xss”
- Milestone set to “2.3.6”
Rizwan Reza May 16th, 2010 @ 02:41 AM
- Tag changed from “xss” to “bugmash, xss”
[bulk edit]
Jeremy Kemper May 23rd, 2010 @ 05:54 PM
- Milestone changed from “2.3.6” to “2.3.7”
[bulk edit]
Jeremy Kemper May 24th, 2010 @ 09:40 AM
- Milestone changed from “2.3.7” to “2.3.8”
[bulk edit]
Jeremy Kemper May 25th, 2010 @ 11:45 PM
- Milestone changed from “2.3.8” to “2.3.9”
[bulk edit]
Martin Gamsjaeger (snusnu) June 3rd, 2010 @ 10:19 PM
I've also added this PATCH link to #4728 and #4762 . Not sure it applies to any or all of them, but I'm looking through tickets that seem somehow related. Here's a patch I needed to add to rails master to get (at least) the usage of #content_tag with a String as 2nd param working:

PATCH: http://github.com/snusnu/rails/commit/7f1b5bc6452cd1ca65dae3283c4af...
Jeremy Kemper August 30th, 2010 @ 02:28 AM
- Milestone changed from “2.3.9” to “2.3.10”
- Importance changed from “” to “Low”
[bulk edit]
Santiago Pastorino February 2nd, 2011 @ 04:50 PM
- State changed from “new” to “open”
This issue has been automatically marked as stale because it has not been commented on for at least three months.

The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.
Santiago Pastorino February 2nd, 2011 @ 04:50 PM
- State changed from “open” to “stale”