From 2bfc4e31df9645b0e1ac1a67786d81cb896f2a5e Mon Sep 17 00:00:00 2001
From: Lachlan Sylvester <lachlan.sylvester@hypothetical.com.au>
Date: Tue, 26 Jan 2010 22:57:23 +1100
Subject: [PATCH] make mail_to return html_safe string when using encode javascript

---
 actionpack/lib/action_view/helpers/url_helper.rb |    2 +-
 actionpack/test/template/url_helper_test.rb      |    6 ++++++
 2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb
index 168a3bd..b71a319 100644
--- a/actionpack/lib/action_view/helpers/url_helper.rb
+++ b/actionpack/lib/action_view/helpers/url_helper.rb
@@ -479,7 +479,7 @@ module ActionView
           "document.write('#{content_tag("a", name || email_address_obfuscated, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
             string << sprintf("%%%x", c)
           end
-          "<script type=\"#{Mime::JS}\">eval(decodeURIComponent('#{string}'))</script>"
+          "<script type=\"#{Mime::JS}\">eval(decodeURIComponent('#{string}'))</script>".html_safe
         elsif encode == "hex"
           email_address_encoded = ''
           email_address_obfuscated.each_byte do |c|
diff --git a/actionpack/test/template/url_helper_test.rb b/actionpack/test/template/url_helper_test.rb
index e904e88..5d18cd0 100644
--- a/actionpack/test/template/url_helper_test.rb
+++ b/actionpack/test/template/url_helper_test.rb
@@ -362,6 +362,12 @@ class UrlHelperTest < ActionView::TestCase
     assert_dom_equal "<script type=\"text/javascript\">eval(decodeURIComponent('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%64%6f%6d%61%69%6e%2e%63%6f%6d%22%3e%4d%79%20%65%6d%61%69%6c%3c%2f%61%3e%27%29%3b'))</script>", mail_to("me@domain.com", "My email", :encode => "javascript", :replace_at => "(at)", :replace_dot => "(dot)")
     assert_dom_equal "<script type=\"text/javascript\">eval(decodeURIComponent('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%6d%65%40%64%6f%6d%61%69%6e%2e%63%6f%6d%22%3e%6d%65%28%61%74%29%64%6f%6d%61%69%6e%28%64%6f%74%29%63%6f%6d%3c%2f%61%3e%27%29%3b'))</script>", mail_to("me@domain.com", nil, :encode => "javascript", :replace_at => "(at)", :replace_dot => "(dot)")
   end
+  
+  def test_mail_to_is_html_safe
+    assert mail_to("me@domain.com", "My email", :encode => "hex").html_safe?
+    assert mail_to("me@domain.com", "My email", :encode => "javascript").html_safe?
+    assert mail_to("me@domain.com", "My email").html_safe?
+  end
 
   def protect_against_forgery?
     false
-- 
1.6.2.463.g49750f