This project is archived and is in readonly mode.
Introduce notion of 'html_safe?' to Strings in preparation for on-by-default XSS
As discussed on the core-list
http://groups.google.com/group/rubyonrails-core/browse_thread/threa...
I've attached the patch I intend to roll-in to 2-3-stable. I'm creating this ticket to give a chance for others to test and object / comment.
- Strings are marked safe with String#html_safe!
- SafeBuffer is a new buffer class which escapes all non-safe strings
- Add a raw helper which marks strings as safe
Note, this change does not impact rendering in any way, you must install the rails_xss plugin to get that behaviour.
-
html_safe.patch
27.8 KB
-
-
Bruno MichelThe button_to helper does not return a string marked as safe. I've made a small patch to fix it.
-
button_to.diff
1.1 KB
-
-
Bruno Michel
Please apply this patch. The button_to helper is broken on rails 2.3 when using the rails_xss plugin (but the parenthesis are there in Rails 3).
-
Bruno Michel
I was advised to create a new ticket for this bug to help tracking the status on. So, it is #3448 Button_to does not return an HTML-safe string.
-
Lenaryjust a question, it looks like this has been applied. has it really?
-
Rizwan Reza- State changed from new to resolved
This was committed as in #3448 Button_to does not return an HTML-safe string.
-
-
