#3518 Link_to doesn't escape its input - Ruby on Rails

Tag changed from 2-3-stable, patch, xss to patch, xss
Milestone cleared.

Can't apply this to 2-3-stable as it'll break people's apps who have already added h() calls, we can fix it in master though where h() is idempotent.

November 30th, 2009 @ 08:35 PM

Jared Fine

I agree with Bruno and Ryan, the way it currently functions seems backwards. To wrap raw html with a link seems much more the exception rather than the rule. There aren't even that many legal html elements you can have inside of an anchor. Ideally link_to (and related helpers, button_to, etc) should escape the first argument by default and allow override by passing an option such as :raw => true.

December 1st, 2009 @ 03:30 AM

Bruno Michel

This bug is not present in Rails 3. The ticket can be closed if the patch won't be applied in Rails 2.3.

February 6th, 2010 @ 09:11 PM

kevmoo

This should be fixed in the 2.3 track.

It's totally broken and I'm guessing 2.3 is not dying when 3.0 ships.

Right?

February 7th, 2010 @ 07:50 AM

trevor

re:

There aren't even that many legal html elements you can have inside of an anchor.

html5 changes this, from http://meyerweb.com/eric/html-xhtml/html5-linking.html -

"Change a so that it can wrap around any arbitrary collection of elements"

from http://www.whatwg.org/specs/web-apps/current-work/multipage/text-le... -

 <a href="http://ad.example.com/?adid=1929&amp;pubid=1422">
  <section>
   <h1>Mellblomatic 9000!</h1>
   <p>Turn all your widgets into mellbloms!</p>
   <p>Only $9.99 plus shipping and handling.</p>
  </section>
 </a>

February 8th, 2010 @ 05:58 AM

Santiago Pastorino

State changed from new to wontfix

On 3.0 is working that way.
It's automatically escaped because you start with a SafeBuffer and the output builder concat with the SafeBuffer he manages using this method from SafeBuffer

module ActiveSupport #:nodoc:
  class SafeBuffer < String
    def concat(value)
      if value.html_safe?
        super(value)
      else
        super(ERB::Util.h(value))
      end
    end
    alias << concat
  end
end

What thing you're saying that's not working?
Did you try the latest version of 2-3-stable with http://github.com/rails/rails_xss

March 8th, 2010 @ 03:48 AM

Bruno Michel

It works fine for Rails 2.3 with Rails XSS. The problem was fixed the 18th february by DHH himself with this commit http://github.com/dhh/rails_xss/commit/afc1610fe4b94150faee98c16f15....

March 8th, 2010 @ 08:25 PM

Jeremy Kemper

Milestone set to 3.0.2
Importance changed from to

[bulk edit]

October 15th, 2010 @ 11:01 PM

Link_to doesn't escape its input

Activity