link_to XSS problem

-1

I cannot reproduce this on the latest edge. Perhaps it has recently been fixed?

This was with 2.3.5. It does look like it's fixed in Rails 3.

Backport?

Using rails_xss does not fix the problem. The unsafe HTML is included in the link_to tag, and marked as safe!

First of all, that's the expected behavior without rails_xss.
But anyways sorry i wasn't clear enough, I should have said that it works on latest 2-3-stable branch and using http://github.com/rails/rails_xss
That was already fixed with the Backport José and i did of master branch.

See links below:
http://github.com/rails/rails/commit/9ca6df83f606a0fb8be3815328111d...
http://github.com/rails/rails_xss/commit/8a6fc54a9b3a715fb3c73d8c73...

Perhaps i shouldn't change the state to wontfix but resolved or duplicate

Oh! I wasn't aware of http://github.com/rails/rails_xss I'm currently using http://github.com/NZKoz/rails_xss with 2.3.5

Should I switch? Should everyone?

http://github.com/rails/rails_xss doesn't work with 2.3.5.
You should use it with the next 2.3.6 or for now 2-3-stable branch

Hm. I guess I'll wait for 2.3.6.

This bug still exists using Rails 2.3.8 and http://github.com/rails/rails_xss

not_safe = "<i>XSS is fun</i>"
link_to(not_safe, "/")

# =>

<a href=\"/\"><i>XSS is fun</i></a>

Please can you upload a zip with your app?

This shows the bug, but maybe I am just not including all the right helpers, since it does work from a template.

foo.rb

class << self
  include ActionView::Helpers::UrlHelper
  include ActionView::Helpers::TagHelper
end
not_safe = "<i>XSS is fun</i>"
puts link_to(not_safe, "/").inspect

> ruby script/runner foo.rb
"<a href=\"/\"><i>XSS is fun</i></a>"

Greg: this http://github.com/rails/rails_xss/commit/14b75220111a7256efae6ac175... solve your issue upgrade to the latest rails_xss

Indeed it does! Thanks! This ticket is done, from my perspective.