This project is archived and is in readonly mode.

Changeset [9415935902f120a9bac0bfce7129725a0db38ed3] by Michael Koziarski

Revision 9415935902f120a9bac0bfce7129725a0db38ed3, committed by Michael Koziarski · October 7th, 2009 @ 09:31 PM

Switch to on-by-default XSS escaping for rails.

This consists of:

String#html_safe! a method to mark a string as 'safe'
ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
Calls to String#html_safe! throughout the rails helpers
a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
New ERB implementation based on erubis which uses a SafeBuffer instead of a String

Hat tip to Django for the inspiration.
http://github.com/rails/rails/commit/9415935902f120a9bac0bfce712972...

36 changed files

A actionpack/lib/action_view/helpers/raw_output_helper.rb
A actionpack/lib/action_view/safe_buffer.rb
A actionpack/test/controller/output_escaping_test.rb
A actionpack/test/template/raw_output_helper_test.rb
A actionpack/test/view/safe_buffer_test.rb
A activesupport/lib/active_support/core_ext/string/output_safety.rb
M actionpack/Gemfile
M actionpack/lib/action_view.rb
M actionpack/lib/action_view/base.rb
M actionpack/lib/action_view/erb/util.rb
M actionpack/lib/action_view/helpers.rb
M actionpack/lib/action_view/helpers/active_model_helper.rb
M actionpack/lib/action_view/helpers/asset_tag_helper.rb
M actionpack/lib/action_view/helpers/capture_helper.rb
M actionpack/lib/action_view/helpers/date_helper.rb
M actionpack/lib/action_view/helpers/form_helper.rb
M actionpack/lib/action_view/helpers/form_options_helper.rb
M actionpack/lib/action_view/helpers/form_tag_helper.rb
M actionpack/lib/action_view/helpers/prototype_helper.rb
M actionpack/lib/action_view/helpers/sanitize_helper.rb
M actionpack/lib/action_view/helpers/tag_helper.rb
M actionpack/lib/action_view/helpers/url_helper.rb
M actionpack/lib/action_view/render/partials.rb
M actionpack/lib/action_view/template/handlers/erb.rb
M actionpack/lib/action_view/test_case.rb
M actionpack/test/controller/render_test.rb
M actionpack/test/template/asset_tag_helper_test.rb
M actionpack/test/template/erb_util_test.rb
M actionpack/test/template/form_helper_test.rb
M actionpack/test/template/render_test.rb
M actionpack/test/template/sanitize_helper_test.rb
M actionpack/test/template/tag_helper_test.rb
M actionpack/test/template/test_case_test.rb
M actionpack/test/template/url_helper_test.rb
M activesupport/lib/active_support/core_ext/string.rb
M activesupport/test/core_ext/string_ext_test.rb