This project is archived and is in readonly mode.

#5545 ✓resolved
Jakub Suder

capture helper assumes that text is html_safe

Reported by Jakub Suder | September 3rd, 2010 @ 12:04 PM | in 3.0.2

That may cause XSS issues if you don't expect it...


<p><%= @profile.location %></p>
<p><%= capture { @profile.location } %></p>
<p><%= content_tag(:div, @profile.location) %></p>
<p><%= content_tag(:div) { @profile.location } %></p>

# result:

<p>Kraków, Poland &lt;h1&gt;foo&lt;h1&gt;</p> 
<p>Kraków, Poland <h1>foo<h1></p> 
<p><div>Kraków, Poland &lt;h1&gt;foo&lt;h1&gt;</div></p> 
<p><div>Kraków, Poland <h1>foo<h1></div></p>

Comments and changes to this ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

<h2 style="font-size: 14px">Tickets have moved to Github</h2>

The new ticket tracker is available at <a href=""></a>


Referenced by