This project is archived and is in readonly mode.
Changeset [9415935902f120a9bac0bfce7129725a0db38ed3] by Michael Koziarski
October 7th, 2009 @ 09:31 PM
Switch to on-by-default XSS escaping for rails.
This consists of:
- String#html_safe! a method to mark a string as 'safe'
- ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
- Calls to String#html_safe! throughout the rails helpers
- a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
- New ERB implementation based on erubis which uses a SafeBuffer instead of a String
Hat tip to Django for the inspiration.
http://github.com/rails/rails/commit/9415935902f120a9bac0bfce712972...
Committed by Michael Koziarski
- A actionpack/lib/action_view/helpers/raw_output_helper.rb
- A actionpack/lib/action_view/safe_buffer.rb
- A actionpack/test/controller/output_escaping_test.rb
- A actionpack/test/template/raw_output_helper_test.rb
- A actionpack/test/view/safe_buffer_test.rb
- A activesupport/lib/active_support/core_ext/string/output_safety.rb
- M actionpack/Gemfile
- M actionpack/lib/action_view.rb
- M actionpack/lib/action_view/base.rb
- M actionpack/lib/action_view/erb/util.rb
- M actionpack/lib/action_view/helpers.rb
- M actionpack/lib/action_view/helpers/active_model_helper.rb
- M actionpack/lib/action_view/helpers/asset_tag_helper.rb
- M actionpack/lib/action_view/helpers/capture_helper.rb
- M actionpack/lib/action_view/helpers/date_helper.rb
- M actionpack/lib/action_view/helpers/form_helper.rb
- M actionpack/lib/action_view/helpers/form_options_helper.rb
- M actionpack/lib/action_view/helpers/form_tag_helper.rb
- M actionpack/lib/action_view/helpers/prototype_helper.rb
- M actionpack/lib/action_view/helpers/sanitize_helper.rb
- M actionpack/lib/action_view/helpers/tag_helper.rb
- M actionpack/lib/action_view/helpers/url_helper.rb
- M actionpack/lib/action_view/render/partials.rb
- M actionpack/lib/action_view/template/handlers/erb.rb
- M actionpack/lib/action_view/test_case.rb
- M actionpack/test/controller/render_test.rb
- M actionpack/test/template/asset_tag_helper_test.rb
- M actionpack/test/template/erb_util_test.rb
- M actionpack/test/template/form_helper_test.rb
- M actionpack/test/template/render_test.rb
- M actionpack/test/template/sanitize_helper_test.rb
- M actionpack/test/template/tag_helper_test.rb
- M actionpack/test/template/test_case_test.rb
- M actionpack/test/template/url_helper_test.rb
- M activesupport/lib/active_support/core_ext/string.rb
- M activesupport/test/core_ext/string_ext_test.rb
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>