This project is archived and is in readonly mode.

over-escaping of content_for in 2.3.7

#4681

In 2.3.7 (and not 2.3.6) content passed from my view to the layout via a content_for block is being over-escaped. I am not using the rails_xss plugin yet.

Given a view that looks like (also available in a gist @ http://gist.github.com/411971):

<%content_for :sidebar do %>
  <h2>Sidebar</h2>
  <p><%=link_to "somewhere", "http://www.google.com/"%></p>
<% end %>

<h1>Main Heading</h1>

And a layout like:

<html>
  <head>
    <title>boo</title>
  </head>
  <body>
    <div id="sidebar">
      <%= yield :sidebar%>
    </div>
    <div id="content">
      <%= yield %>
    </div>
  </body>
</html>

I get the following output:

<html>
  <head>
    <title>boo</title>
  </head>
  <body>
    <div id="sidebar">
      
  &lt;h2&gt;Sidebar&lt;/h2&gt;

  &lt;p&gt;<a href="http://www.google.com/">somewhere</a>&lt;/p&gt;

    </div>
    <div id="content">
      

<h1>Main Heading</h1>

    </div>
  </body>

</html>

Reported by James Healy · May 24th, 2010 @ 05:05 PM

Activity

Uģis Ozols
I believe this is the fix for this issue - http://github.com/rails/rails/commit/c66013e2c5dc77e9bfa06111fb8841...

May 24th, 2010 @ 05:56 PM
Jeremy Kemper
- Milestone set to 2.3.8
- State changed from new to resolved
May 24th, 2010 @ 06:39 PM
Matthew Horan
This seems to still be an issue. See the comments at http://weblog.rubyonrails.org/2010/5/25/ruby-on-rails-2-3-8-released. When concatenating HTML on to the end of HTML generated by, e.g. FormBuilder, the concatenated HTML is escaped. This was not the behavior with releases <= 2.3.5 (not sure about 2.3.6.)

May 25th, 2010 @ 04:11 PM
James Healy

the content_for issue was resolved in 2.3.8, but I'm still getting the same issue as Matthew when concatenating strings in form builders.

I haven't tested yet, but it looks like it might've been fixed as part of ticket #4695 string added to rails_helpers gets HTML escaped

May 26th, 2010 @ 01:42 AM