#3448 Button_to does not return an HTML-safe string - Ruby on Rails

Bruno Michel

Tag changed from 2-3-stable, xss to 2-3-stable, patch, xss

November 1st, 2009 @ 01:08 PM

Bruno Michel

No news on this ticket?

November 10th, 2009 @ 10:51 PM

Michael Koziarski

Milestone set to 2.3.6

November 30th, 2009 @ 08:36 PM

Santiago Pastorino

State changed from new to open

Yes, you're right Bruno.
First of all can you provide a failing test case?, and must say that your patch is wrong you're not on the current 2-3-stable branch.

The actual code is:

"<form method=\"#{form_method}\" action=\"#{escape_once url}\" class=\"button-to\"><div>" +
  method_tag + tag("input", html_options) + request_token_tag + "</div></form>".html_safe

and should be:

("<form method=\"#{form_method}\" action=\"#{escape_once url}\" class=\"button-to\"><div>" +
   method_tag + tag("input", html_options) + request_token_tag + "</div></form>").html_safe

not that is html_safe not html_safe!

March 8th, 2010 @ 08:56 PM

Bruno Michel

and must say that your patch is wrong you're not on the current 2-3-stable branch.

Hey, I was on the 2-3-stable when I created the patch in October last year ;-) But html_safe! has been deprecated in favor of html_safe since (in January IIRC).

First of all can you provide a failing test case?

Sure, I've attached the new patch with a unit test.

March 8th, 2010 @ 10:06 PM

Bruno Michel

and must say that your patch is wrong you're not on the current 2-3-stable branch.

Hey, I was on the 2-3-stable when I created the patch in October last year ;-) But html_safe! has been deprecated in favor of html_safe since (in January IIRC).