This project is archived and is in readonly mode.
select_tag wrongly escaped option tags passed to it in rails 3.0.0
-
David Trasbo
- Assigned user set to Rohit Arondekar
You have to explicitly mark the string you're passing to
select_tagashtml_safelike so:select_tag :idc_id, "<option></option>".html_safeThis can be closed.
-
Rohit Arondekar
- State changed from new to invalid
- Importance changed from to Low
This might be helpful in understanding the new .html_safe and .html_safe? methods and how Rails 3 uses them. http://asciicasts.com/episodes/204-xss-protection-in-rails-3
-
foxban
I didn't find anything talking about "html_safe" in the docs, for instance: http://guides.rubyonrails.org/form_helpers.html.
Maybe I should read the docs more carefully, :-)