From f17eb449b8f16ebf2283c1a75375d23fcf6fb9b7 Mon Sep 17 00:00:00 2001
From: Daniel Morrison <daniel@collectiveidea.com>
Date: Sat, 26 Feb 2011 13:34:39 -0500
Subject: [PATCH] Convert csrf_meta_tags to use the tag helper.

---
 actionpack/lib/action_view/helpers/csrf_helper.rb  |   10 ++++++----
 .../controller/request_forgery_protection_test.rb  |   11 +++++++----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/actionpack/lib/action_view/helpers/csrf_helper.rb b/actionpack/lib/action_view/helpers/csrf_helper.rb
index 65c8deb..0b8db63 100644
--- a/actionpack/lib/action_view/helpers/csrf_helper.rb
+++ b/actionpack/lib/action_view/helpers/csrf_helper.rb
@@ -17,10 +17,12 @@ module ActionView
       # Note that regular forms generate hidden fields, and that Ajax calls are whitelisted,
       # so they do not use these tags.
       def csrf_meta_tags
-        <<-METAS.strip_heredoc.chomp.html_safe if protect_against_forgery?
-          <meta name="csrf-param" content="#{Rack::Utils.escape_html(request_forgery_protection_token)}"/>
-          <meta name="csrf-token" content="#{Rack::Utils.escape_html(form_authenticity_token)}"/>
-        METAS
+        if protect_against_forgery?
+          [].tap do |tags|
+            tags << tag('meta', {:name => 'csrf-param', :content => request_forgery_protection_token})
+            tags << tag('meta', {:name => 'csrf-token', :content => form_authenticity_token})
+          end.join("\n").html_safe
+        end
       end
 
       # For backwards compatibility.
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index d520b5e..063b928 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -172,13 +172,16 @@ end
 class RequestForgeryProtectionControllerTest < ActionController::TestCase
   include RequestForgeryProtectionTests
 
+  test 'should emit a csrf-param meta tag' do
+    ActiveSupport::SecureRandom.stubs(:base64).returns(@token + '<=?')
+    get :meta
+    assert_select 'meta[name=?][content=?]', 'csrf-param', 'authenticity_token'
+  end
+
   test 'should emit a csrf-token meta tag' do
     ActiveSupport::SecureRandom.stubs(:base64).returns(@token + '<=?')
     get :meta
-    assert_equal <<-METAS.strip_heredoc.chomp, @response.body
-      <meta name="csrf-param" content="authenticity_token"/>
-      <meta name="csrf-token" content="cf50faa3fe97702ca1ae&lt;=?"/>
-    METAS
+    assert_select 'meta[name=?][content=?]', 'csrf-token', 'cf50faa3fe97702ca1ae&lt;=?'
   end
 end
 
-- 
1.7.4