This project is archived and is in readonly mode.
Changeset [80da8eb43dfabb4ca9f0adcb431882d03e6388bb] by Michael Koziarski
October 8th, 2009 @ 01:59 AM
Merge the prerequisites for on-by-default XSS escaping into rails.
This consists of:
- String#html_safe! a method to mark a string as 'safe'
- ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
- Calls to String#html_safe! throughout the rails helpers
- a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
Note, this does not give you on-by-default XSS escaping in 2.3 applications. To get that you'll need to install a plugin:
http://github.com/nzkoz/rails_xss
http://github.com/rails/rails/commit/80da8eb43dfabb4ca9f0adcb431882...
Committed by Michael Koziarski
- A actionpack/lib/action_view/helpers/raw_output_helper.rb
- A actionpack/lib/action_view/safe_buffer.rb
- A actionpack/test/template/raw_output_helper_test.rb
- A actionpack/test/view/safe_buffer_test.rb
- A activesupport/lib/active_support/core_ext/string/output_safety.rb
- M actionpack/lib/action_view.rb
- M actionpack/lib/action_view/erb/util.rb
- M actionpack/lib/action_view/helpers.rb
- M actionpack/lib/action_view/helpers/active_record_helper.rb
- M actionpack/lib/action_view/helpers/asset_tag_helper.rb
- M actionpack/lib/action_view/helpers/capture_helper.rb
- M actionpack/lib/action_view/helpers/date_helper.rb
- M actionpack/lib/action_view/helpers/form_helper.rb
- M actionpack/lib/action_view/helpers/form_options_helper.rb
- M actionpack/lib/action_view/helpers/form_tag_helper.rb
- M actionpack/lib/action_view/helpers/prototype_helper.rb
- M actionpack/lib/action_view/helpers/sanitize_helper.rb
- M actionpack/lib/action_view/helpers/tag_helper.rb
- M actionpack/lib/action_view/helpers/url_helper.rb
- M actionpack/lib/action_view/partials.rb
- M actionpack/test/template/asset_tag_helper_test.rb
- M actionpack/test/template/form_helper_test.rb
- M actionpack/test/template/sanitize_helper_test.rb
- M actionpack/test/template/tag_helper_test.rb
- M activesupport/lib/active_support/core_ext/string.rb
- M activesupport/test/core_ext/string_ext_test.rb
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>