Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

Translations with interpolated strings (not html_safe)

#3794

In #3401 Are I18n yml files thought to be html_safe? (AWDwR3, section 13) (and commit http://github.com/rails/rails/commit/2675e4ef83b2a0fb38f01140d65fbd... ) the translate helper is assumed to return a html_safe string. But now the following code will result in a XSS vulnerability:

<%= t(:greeting, :name => @user.name) %>

Reported by Deleted User · January 27th, 2010 @ 10:06 AM

State: stale
Milestone: none
Assigned to: nobody
Importance: Low

Activity

  1. Rohit Arondekar
    Rohit Arondekar
    • State changed from new to stale
    • Importance changed from to Low

    Marking ticket as stale. If this is still an issue please leave a comment with suggested changes, creating a patch with tests, rebasing an existing patch or just confirming the issue on a latest release or master/branches.

    October 8th, 2010 @ 02:31 AM