Merge pull request #2872 from sikachu/content_tag_html_safe

Make sure that result from content_tag_for with collection is html_safe

2 files changed, 13 insertions, 1 deletions

diff --git a/actionpack/lib/action_view/helpers/record_tag_helper.rb b/actionpack/lib/action_view/helpers/record_tag_helper.rb
index ad8896a2fd..cbee517adc 100644
--- a/actionpack/lib/action_view/helpers/record_tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/record_tag_helper.rb
@@ -84,7 +84,7 @@ module ActionView
         if single_or_multiple_records.respond_to?(:to_ary)
           single_or_multiple_records.to_ary.map do |single_record|
             capture { content_tag_for_single_record(tag_name, single_record, prefix, options, &block) }
-          end.join("\n")
+          end.join("\n").html_safe
         else
           content_tag_for_single_record(tag_name, single_or_multiple_records, prefix, options, &block)
         end
diff --git a/actionpack/test/template/record_tag_helper_test.rb b/actionpack/test/template/record_tag_helper_test.rb
index 7d38b01c1b..7f23629e05 100644
--- a/actionpack/test/template/record_tag_helper_test.rb
+++ b/actionpack/test/template/record_tag_helper_test.rb
@@ -83,4 +83,16 @@ class RecordTagHelperTest < ActionView::TestCase
     actual = div_for([post_1, post_2]) { |post| concat post.body }
     assert_dom_equal expected, actual
   end
+
+  def test_content_tag_for_single_record_is_html_safe
+    result = div_for(@post, :class => "bar") { concat @post.body }
+    assert result.html_safe?
+  end
+
+  def test_content_tag_for_collection_is_html_safe
+    post_1 = Post.new.tap { |post| post.id = 101; post.body = "Hello!"; post.persisted = true }
+    post_2 = Post.new.tap { |post| post.id = 102; post.body = "World!"; post.persisted = true }
+    result = content_tag_for(:li, [post_1, post_2]) { |post| concat post.body }
+    assert result.html_safe?
+  end
 end