From 92e7ff335dedf2c36f42fa5e65097cbf74281523 Mon Sep 17 00:00:00 2001
From: Adam McCrea
Date: Wed, 20 Jan 2010 15:18:25 -0500
Subject: [PATCH 2/2] simple_format should escape its input
---
actionpack/lib/action_view/helpers/text_helper.rb | 2 +-
actionpack/test/template/text_helper_test.rb | 4 ++++
2 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb
index 86f1e15..4db4699 100644
--- a/actionpack/lib/action_view/helpers/text_helper.rb
+++ b/actionpack/lib/action_view/helpers/text_helper.rb
@@ -327,7 +327,7 @@ module ActionView
# # => "Look ma! A class!
"
def simple_format(text, html_options={})
start_tag = tag('p', html_options, true)
- text = text.to_s.dup
+ text = h(text.to_s.dup)
text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n
text.gsub!(/\n\n+/, "
\n\n#{start_tag}") # 2+ newline -> paragraph
text.gsub!(/([^\n]\n)(?=[^\n])/, '\1
') # 1 newline -> br
diff --git a/actionpack/test/template/text_helper_test.rb b/actionpack/test/template/text_helper_test.rb
index 8b60360..93bbd90 100644
--- a/actionpack/test/template/text_helper_test.rb
+++ b/actionpack/test/template/text_helper_test.rb
@@ -44,6 +44,10 @@ class TextHelperTest < ActionView::TestCase
assert simple_format("A String").html_safe?
end
+ def test_simple_format_should_escape_its_input
+ assert_equal "<b> String with html </b>
", simple_format(" String with html ")
+ end
+
def test_truncate
assert_equal "Hello World!", truncate("Hello World!", :length => 12)
assert_equal "Hello Wor...", truncate("Hello World!!", :length => 12)
--
1.6.4.2