Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

Inconsistent escaping in xml rendering

#4664

_foo.xml.builder:

xml.script('alert("Pwned");')

index.html.erb:

<%= render :partial=>'foo.xml' %>
<%= render :partial=>'foo.xml', :collection=>[{}] %>

output:

&lt;script&gt;alert(&quot;Pwned&quot;);&lt;/script&gt;
<script>alert("Pwned");</script>

what's happening is that the second render call is triggering the render_collection codepath, which isn't returning the XML escaped like the first call is.

I guess I'm not even sure which behavior is preferable but consistency would be good.

I wish I could give more in terms of solution & testing but this is about as far as my knowledge goes.

Reported by Elijah Smith · May 22nd, 2010 @ 03:07 AM

State: stale
Milestone: none
Assigned to: nobody
Importance: none

Activity

  1. Santiago Pastorino
    Santiago Pastorino
    • State changed from new to open

    This issue has been automatically marked as stale because it has not been commented on for at least three months.

    The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

    Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.

    February 2nd, 2011 @ 04:38 PM

  2. Santiago Pastorino
    Santiago Pastorino
    • State changed from open to stale

    February 2nd, 2011 @ 04:38 PM