This project is archived and is in readonly mode.
Inconsistent escaping in xml rendering
Reported by Elijah Smith | May 22nd, 2010 @ 03:07 AM
_foo.xml.builder:
xml.script('alert("Pwned");')
index.html.erb:
<%= render :partial=>'foo.xml' %>
<%= render :partial=>'foo.xml', :collection=>[{}] %>
output:
<script>alert("Pwned");</script>
<script>alert("Pwned");</script>
what's happening is that the second render call is triggering the render_collection codepath, which isn't returning the XML escaped like the first call is.
I guess I'm not even sure which behavior is preferable but
consistency would be good.
I wish I could give more in terms of solution & testing but this is about as far as my knowledge goes.
Comments and changes to this ticket
-
Santiago Pastorino February 2nd, 2011 @ 04:38 PM
- State changed from “new” to “open”
This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.
Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.
-
Santiago Pastorino February 2nd, 2011 @ 04:38 PM
- State changed from “open” to “stale”
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
Elijah Smith