From 0802572f904fcba1b858beda258c1e0980c65cdb Mon Sep 17 00:00:00 2001
From: Brian Morearty <github2@morearty.org>
Date: Sun, 13 Feb 2011 13:35:26 -0800
Subject: [PATCH] Add deprecation warnings to helpers that take an the escape parameter/option [#6421]

Deprecate the escape parameter/option for these helper methods:
  FormTagHelper#text_area_tag
  TagHelper#content_tag
  TagHelper#tag
---
 .../lib/action_view/helpers/asset_tag_helper.rb    |    2 +-
 .../lib/action_view/helpers/form_options_helper.rb |    2 +-
 .../lib/action_view/helpers/form_tag_helper.rb     |   13 +++++++++++--
 actionpack/lib/action_view/helpers/tag_helper.rb   |   18 ++++++++++++++----
 actionpack/lib/action_view/helpers/text_helper.rb  |    7 +++++--
 actionpack/test/template/form_tag_helper_test.rb   |   18 ++++++++++++++----
 actionpack/test/template/tag_helper_test.rb        |   11 ++++++++---
 7 files changed, 54 insertions(+), 17 deletions(-)

diff --git a/actionpack/lib/action_view/helpers/asset_tag_helper.rb b/actionpack/lib/action_view/helpers/asset_tag_helper.rb
index 6a75a7c..fe8acbd 100644
--- a/actionpack/lib/action_view/helpers/asset_tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/asset_tag_helper.rb
@@ -827,7 +827,7 @@ module ActionView
         end
 
         def stylesheet_tag(source, options)
-          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => html_escape(path_to_stylesheet(source)) }.merge(options), false, false)
+          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => html_escape(path_to_stylesheet(source)) }.merge(options))
         end
 
         def compute_javascript_paths(*args)
diff --git a/actionpack/lib/action_view/helpers/form_options_helper.rb b/actionpack/lib/action_view/helpers/form_options_helper.rb
index 0920897..aad6afb 100644
--- a/actionpack/lib/action_view/helpers/form_options_helper.rb
+++ b/actionpack/lib/action_view/helpers/form_options_helper.rb
@@ -448,7 +448,7 @@ module ActionView
       # wrap the output in an appropriate <tt><select></tt> tag.
       def grouped_options_for_select(grouped_options, selected_key = nil, prompt = nil)
         body = ''
-        body << content_tag(:option, prompt, { :value => "" }, true) if prompt
+        body << content_tag(:option, prompt, { :value => "" }) if prompt
 
         grouped_options = grouped_options.sort if grouped_options.is_a?(Hash)
 
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb
index 861e58d..d9bd794 100644
--- a/actionpack/lib/action_view/helpers/form_tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb
@@ -260,13 +260,14 @@ module ActionView
 
       # Creates a text input area; use a textarea for longer text inputs such as blog posts or descriptions.
       #
+      # By default, the contents of the text input are HTML escaped.  If you need unescaped contents,
+      # call html_safe on the content parameter.
+      #
       # ==== Options
       # * <tt>:size</tt> - A string specifying the dimensions (columns by rows) of the textarea (e.g., "25x10").
       # * <tt>:rows</tt> - Specify the number of rows in the textarea
       # * <tt>:cols</tt> - Specify the number of columns in the textarea
       # * <tt>:disabled</tt> - If set to true, the user will not be able to use this input.
-      # * <tt>:escape</tt> - By default, the contents of the text input are HTML escaped.
-      #   If you need unescaped contents, set this to false.
       # * Any other key creates standard HTML attributes for the tag.
       #
       # ==== Examples
@@ -294,6 +295,14 @@ module ActionView
           options["cols"], options["rows"] = size.split("x") if size.respond_to?(:split)
         end
 
+        if options.key?("escape")
+          if options["escape"]
+            ActiveSupport::Deprecation.warn %Q{text_area_tag's "escape" option is deprecated.  It will be removed in Rails 3.1.}, caller
+          else
+            ActiveSupport::Deprecation.warn %Q{text_area_tag's "escape" option is deprecated.  It will be removed in Rails 3.1.  Call html_safe on the content to avoid escaping it.}, caller
+          end
+        end
+
         escape = options.key?("escape") ? options.delete("escape") : true
         content = html_escape(content) if escape
 
diff --git a/actionpack/lib/action_view/helpers/tag_helper.rb b/actionpack/lib/action_view/helpers/tag_helper.rb
index 5d032b3..3ad3661 100644
--- a/actionpack/lib/action_view/helpers/tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/tag_helper.rb
@@ -21,8 +21,8 @@ module ActionView
       # Returns an empty HTML tag of type +name+ which by default is XHTML
       # compliant. Set +open+ to true to create an open tag compatible
       # with HTML 4.0 and below. Add HTML attributes by passing an attributes
-      # hash to +options+. Set +escape+ to false to disable attribute value
-      # escaping.
+      # hash to +options+. Call html_safe on the attribute values to prevent
+      # them from being escaped.
       #
       # ==== Options
       # The +options+ hash is used with attributes with no value like (<tt>disabled</tt> and
@@ -42,9 +42,13 @@ module ActionView
       #   tag("img", { :src => "open & shut.png" })
       #   # => <img src="open &amp; shut.png" />
       #
-      #   tag("img", { :src => "open &amp; shut.png" }, false, false)
+      #   tag("img", { :src => "open &amp; shut.png".html_safe })
       #   # => <img src="open &amp; shut.png" />
       def tag(name, options = nil, open = false, escape = true)
+        unless escape
+          ActiveSupport::Deprecation.warn %Q{tag's "escape" parameter is deprecated.  It will be removed in Rails 3.1.  Call html_safe on the content and attribute values to prevent HTML escaping.}, caller
+        end
+
         "<#{name}#{tag_options(options, escape) if options}#{open ? ">" : " />"}".html_safe
       end
 
@@ -52,7 +56,7 @@ module ActionView
       # HTML attributes by passing an attributes hash to +options+.
       # Instead of passing the content as an argument, you can also use a block
       # in which case, you pass your +options+ as the second parameter.
-      # Set escape to false to disable attribute value escaping.
+      # Call html_safe on the content and the attribute values to disable HTML escaping.
       #
       # ==== Options
       # The +options+ hash is used with attributes with no value like (<tt>disabled</tt> and
@@ -64,6 +68,8 @@ module ActionView
       #    # => <p>Hello world!</p>
       #   content_tag(:div, content_tag(:p, "Hello world!"), :class => "strong")
       #    # => <div class="strong"><p>Hello world!</p></div>
+      #   content_tag(:p, "<b>Hello</b> world!".html_safe)
+      #    # => <p><b>Hello</b> world!</p>
       #   content_tag("select", options, :multiple => true)
       #    # => <select multiple="multiple">...options...</select>
       #
@@ -72,6 +78,10 @@ module ActionView
       #   <% end -%>
       #    # => <div class="strong">Hello world!</div>
       def content_tag(name, content_or_options_with_block = nil, options = nil, escape = true, &block)
+        unless escape
+          ActiveSupport::Deprecation.warn %Q{content_tag's "escape" parameter is deprecated.  It will be removed in Rails 3.1.  Call html_safe on the content and attribute values to prevent HTML escaping.}, caller
+        end
+
         if block_given?
           options = content_or_options_with_block if content_or_options_with_block.is_a?(Hash)
           content_tag_string(name, capture(&block), options, escape)
diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb
index 21088c7..4dff7e1 100644
--- a/actionpack/lib/action_view/helpers/text_helper.rb
+++ b/actionpack/lib/action_view/helpers/text_helper.rb
@@ -497,11 +497,14 @@ module ActionView
               link_text = block_given?? yield(href) : href
               href = 'http://' + href unless scheme
 
-              unless options[:sanitize] == false
+              if options.fetch(:sanitize, true)
                 link_text = sanitize(link_text)
                 href      = sanitize(href)
+              else
+                link_text = link_text.html_safe
+                href      = href.html_safe
               end
-              content_tag(:a, link_text, link_attributes.merge('href' => href), !!options[:sanitize]) + punctuation.reverse.join('')
+              content_tag(:a, link_text, link_attributes.merge('href' => href)) + punctuation.reverse.join('')
             end
           end.html_safe
         end
diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb
index 532f086..9c3f538 100644
--- a/actionpack/test/template/form_tag_helper_test.rb
+++ b/actionpack/test/template/form_tag_helper_test.rb
@@ -236,14 +236,24 @@ class FormTagHelperTest < ActionView::TestCase
     assert_dom_equal expected, actual
   end
 
-  def test_text_area_tag_unescaped_content
-    actual = text_area_tag "body", "<b>hello world</b>", :size => "20x40", :escape => false
+  def test_text_area_tag_safe_content
+    actual = text_area_tag "body", "<b>hello world</b>".html_safe, :size => "20x40"
     expected = %(<textarea cols="20" id="body" name="body" rows="40"><b>hello world</b></textarea>)
     assert_dom_equal expected, actual
   end
 
-  def test_text_area_tag_unescaped_nil_content
-    actual = text_area_tag "body", nil, :escape => false
+  def test_text_area_tag_escape_option_deprecated
+    actual = assert_deprecated('escape') do
+       text_area_tag "body", "<b>hello world</b>", :size => "20x40", :escape => false
+    end
+    expected = %(<textarea cols="20" id="body" name="body" rows="40"><b>hello world</b></textarea>)
+    assert_dom_equal expected, actual
+  end
+
+  def test_text_area_tag_unescaped_nil_content_deprecated
+    actual = assert_deprecated('escape') do
+      text_area_tag "body", nil, :escape => false
+    end
     expected = %(<textarea id="body" name="body"></textarea>)
     assert_dom_equal expected, actual
   end
diff --git a/actionpack/test/template/tag_helper_test.rb b/actionpack/test/template/tag_helper_test.rb
index 85ac515..a1c9740 100644
--- a/actionpack/test/template/tag_helper_test.rb
+++ b/actionpack/test/template/tag_helper_test.rb
@@ -39,8 +39,12 @@ class TagHelperTest < ActionView::TestCase
                  content_tag("a", "Create", :href => "create")
     assert_equal "<p>&lt;script&gt;evil_js&lt;/script&gt;</p>",
                  content_tag(:p, '<script>evil_js</script>')
+    assert_deprecated do
+      assert_equal "<p><script>evil_js</script></p>",
+                   content_tag(:p, '<script>evil_js</script>', nil, false)
+    end
     assert_equal "<p><script>evil_js</script></p>",
-                 content_tag(:p, '<script>evil_js</script>', nil, false)
+                 content_tag(:p, '<script>evil_js</script>'.html_safe)
   end
 
   def test_content_tag_with_block_in_erb
@@ -83,7 +87,7 @@ class TagHelperTest < ActionView::TestCase
   end
 
   def test_content_tag_with_unescaped_array_class
-    str = content_tag('p', "limelight", {:class => ["song", "play>"]}, false)
+    str = assert_deprecated { content_tag('p', "limelight", {:class => ["song", "play>"]}, false) }
     assert_equal "<p class=\"song play>\">limelight</p>", str
   end
 
@@ -108,6 +112,7 @@ class TagHelperTest < ActionView::TestCase
   end
 
   def test_disable_escaping
-    assert_equal '<a href="&amp;" />', tag('a', { :href => '&amp;' }, false, false)
+    assert_deprecated { assert_equal '<a href="&amp;" />', tag('a', { :href => '&amp;' }, false, false) }
+    assert_equal '<a href="&amp;" />', tag('a', { :href => '&amp;'.html_safe })
   end
 end
-- 
1.6.2.2