Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

All changesets

Changeset [80da8eb43dfabb4ca9f0adcb431882d03e6388bb] by Michael Koziarski

Revision 80da8eb43dfabb4ca9f0adcb431882d03e6388bb, committed by Michael Koziarski · October 8th, 2009 @ 01:59 AM

Merge the prerequisites for on-by-default XSS escaping into rails.

This consists of:

  • String#html_safe! a method to mark a string as 'safe'
  • ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
  • Calls to String#html_safe! throughout the rails helpers
  • a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)

Note, this does not give you on-by-default XSS escaping in 2.3 applications. To get that you'll need to install a plugin:

http://github.com/nzkoz/rails_xss
http://github.com/rails/rails/commit/80da8eb43dfabb4ca9f0adcb431882...

26 changed files

  • A actionpack/lib/action_view/helpers/raw_output_helper.rb
  • A actionpack/lib/action_view/safe_buffer.rb
  • A actionpack/test/template/raw_output_helper_test.rb
  • A actionpack/test/view/safe_buffer_test.rb
  • A activesupport/lib/active_support/core_ext/string/output_safety.rb
  • M actionpack/lib/action_view.rb
  • M actionpack/lib/action_view/erb/util.rb
  • M actionpack/lib/action_view/helpers.rb
  • M actionpack/lib/action_view/helpers/active_record_helper.rb
  • M actionpack/lib/action_view/helpers/asset_tag_helper.rb
  • M actionpack/lib/action_view/helpers/capture_helper.rb
  • M actionpack/lib/action_view/helpers/date_helper.rb
  • M actionpack/lib/action_view/helpers/form_helper.rb
  • M actionpack/lib/action_view/helpers/form_options_helper.rb
  • M actionpack/lib/action_view/helpers/form_tag_helper.rb
  • M actionpack/lib/action_view/helpers/prototype_helper.rb
  • M actionpack/lib/action_view/helpers/sanitize_helper.rb
  • M actionpack/lib/action_view/helpers/tag_helper.rb
  • M actionpack/lib/action_view/helpers/url_helper.rb
  • M actionpack/lib/action_view/partials.rb
  • M actionpack/test/template/asset_tag_helper_test.rb
  • M actionpack/test/template/form_helper_test.rb
  • M actionpack/test/template/sanitize_helper_test.rb
  • M actionpack/test/template/tag_helper_test.rb
  • M activesupport/lib/active_support/core_ext/string.rb
  • M activesupport/test/core_ext/string_ext_test.rb