This project is archived and is in readonly mode.
text_area_tag should escape contents by default
text_area_tag currently does not HTML-escape its contents/value by default. However, the rest of the form tag helpers do escape their values, and the corresponding text_area method in FormHelper does it as well.
For consistency and security's sake, it seems like text_area_tag should escape its content by default too.
See also discussion here:
http://groups.google.com/group/r...
and previous ticket here:
http://dev.rubyonrails.org/ticke...
Simple patch attached.
-
text_area-escaping.diff
3.06 KB
-
Murray Steele+1
Looks good to me. Also a pretty sensible addition.
-
-
-
Michael Koziarski- Milestone changed from 2.x to 2.3.4
Looks good, but the patch doesn't apply cleanly now.
Can you address that (with perhaps a patch each for master and 2-3-stable) and I'll get it in.
-
Michael Koziarski
Looks good to me.
This patch no longer cleanly applies, but if you can address that I'll
get it in for 2-3 and master. -
Chris MearHere's two new patches, one that applies to the current master branch, and one for the 2-3-stable branch.
-
text_area-escaping.diff
3.08 KB
-
text_area-escaping-2-3-stable.diff
2.96 KB
-
-
Repository
- State changed from new to committed
(from [085db5e128ad4ad8fd042776722c78e194c6d0a4]) Make text_area_tag escape contents by default.
Signed-off-by: Michael Koziarski michael@koziarski.com
[#2015 text_area_tag should escape contents by default state:committed] http://github.com/rails/rails/commit/085db5e128ad4ad8fd042776722c78...