From 228d4122cb2a5020f35a360c6c62d0d2661b1921 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Santiago=20Pastorino=20and=20Jos=C3=A9=20Ignacio=20Costa?=
Date: Fri, 12 Feb 2010 16:51:21 -0200
Subject: [PATCH] simple_format returns a safe buffer escaping unsafe input
---
actionpack/lib/action_view/helpers/text_helper.rb | 4 ++--
actionpack/test/template/text_helper_test.rb | 12 ++++++++++++
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb
index b636173..e5d67fe 100644
--- a/actionpack/lib/action_view/helpers/text_helper.rb
+++ b/actionpack/lib/action_view/helpers/text_helper.rb
@@ -327,12 +327,12 @@ module ActionView
# # => "Look ma! A class!
"
def simple_format(text, html_options={})
start_tag = tag('p', html_options, true)
- text = text.to_s.dup
+ text = h(text)
text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n
text.gsub!(/\n\n+/, "
\n\n#{start_tag}") # 2+ newline -> paragraph
text.gsub!(/([^\n]\n)(?=[^\n])/, '\1
') # 1 newline -> br
text.insert 0, start_tag
- text << ""
+ text.safe_concat ""
end
# Turns all URLs and e-mail addresses into clickable links. The :link option
diff --git a/actionpack/test/template/text_helper_test.rb b/actionpack/test/template/text_helper_test.rb
index 39bea12..9962b7a 100644
--- a/actionpack/test/template/text_helper_test.rb
+++ b/actionpack/test/template/text_helper_test.rb
@@ -40,6 +40,18 @@ class TextHelperTest < ActionView::TestCase
assert_equal %Q(para 1
\n\npara 2
), simple_format("para 1\n\npara 2", :class => 'test')
end
+ def test_simple_format_should_be_html_safe
+ assert simple_format(" test with html tags ").html_safe?
+ end
+
+ def test_simple_format_should_escape_unsafe_input
+ assert_equal "<b> test with unsafe string </b>
", simple_format(" test with unsafe string ")
+ end
+
+ def test_simple_format_should_not_escape_safe_input
+ assert_equal " test with safe string
", simple_format(" test with safe string ".html_safe)
+ end
+
def test_truncate
assert_equal "Hello World!", truncate("Hello World!", :length => 12)
assert_equal "Hello Wor...", truncate("Hello World!!", :length => 12)
--
1.6.0.4