This project is archived and is in readonly mode.
string added to rails_helpers gets HTML escaped
-
Neeraj SinghIn my view it is a consistent behavior.
>> ''+ERB::Util.html_escape('test') + '<br />' => "test<br />" >> ''.html_safe+ERB::Util.html_escape('test') + '<br />' => "test<br />" >> ERB::Util.html_escape('test') + '<br />'.html_safe => "test<br />"In the first example given by the Fjan, not safe html is being added to safe html. Probably you already know the solution and that is to mark br as safe as I did in my last example.
-
FjanYes, it is consistent, however it is also a bug since it is consistently different from Rails versions < 2.3.8 and therefore it breaks a lot of apps which is not allowed in a point release. (I had to fix around 20 occurrences in my apps)
-
Neeraj Singh
Fjan: Looks like you got your wish.
http://github.com/rails/rails/commit/a815f0c5a3a873aefca76f459ce05d...
-
Fjan
great :-)
Well, I fixed everything by now. I actually amended the test helper to find all of them and it found a few more I hadn't caught before. It's a simple one-line addition to the test suite this, I'm going to leave it in:
raise "Double escaped HTML in text (&#{$1};)" if @response.body =~ /&(raquo|lt|gt|nbsp|amp)/ -
Yehuda Katz (wycats)- Milestone set to 2.3.8
- State changed from new to resolved
In the meantime, you can apply the following monkey-patch:
class ActiveSupport::SafeBuffer def concat(*args) super end alias << concat endThis will remove any trace of html_safe concatenation.
-
Jeremy Kemper- Milestone cleared.
-
Dan NuttallThis commit doesn't seem to have made it into the 2.3.8 tag:
http://github.com/rails/rails/blob/v2.3.8/activesupport/lib/active_...Was this an oversight or was it left out for a reason?
-
Matthew Horan
Anyone? Bueller? This has forced us to stick with 2.3.5.