This project is archived and is in readonly mode.

RailsSanitize.white_list_sanitizer.sanitize does not handle \ properly

#954

Sanitizing following html gives broken result.


<img src="backslash.png" alt="\" />

gives


<img src="backslash.png" alt="\&quot; /&gt;">

The character "" (backslash) in HTML(SGML/XML) attributes has no special meaning.

Reported by Tietew · September 2nd, 2008 @ 06:26 AM

Tietew
- Tag changed from 2.1, sanitize to 2.1, patch, sanitize
Attached patch will fix this problem.
- node.rb.patch 876 Bytes
September 2nd, 2008 @ 06:37 AM
Pratik
- Assigned user set to Pratik
- State changed from new to incomplete
Patch is missing tests. Also, could you please upload the patch using git-format-patch - http://rails.lighthouseapp.com/p...?

Thanks.

December 20th, 2008 @ 05:40 PM
CancelProfileIsBroken
- Tag changed from 2.1, patch, sanitize to 2.1, bugmash, patch, sanitize
August 4th, 2009 @ 05:20 PM
Mike Breen
1. I've verified the behavior but this patch busts a lot of other tests.
August 9th, 2009 @ 06:52 PM
Mike Breen
should be "-1"

August 9th, 2009 @ 06:52 PM
Pratik
- State changed from incomplete to wontfix
August 9th, 2009 @ 06:54 PM
CancelProfileIsBroken
- Assigned user cleared.
- Tag changed from 2.1, bugmash, patch, sanitize to 2.1, patch, sanitize
- Milestone cleared.
August 9th, 2009 @ 10:06 PM