diff options
author | José Valim <jose.valim@gmail.com> | 2011-05-07 03:41:26 -0700 |
---|---|---|
committer | José Valim <jose.valim@gmail.com> | 2011-05-07 03:41:26 -0700 |
commit | aaf01cd53718c8aa5b69ac056b997e6dd9893777 (patch) | |
tree | 8541f3d2d89d0646d02311ce16cc063143107d7f | |
parent | 9cc18c52faeebaad6a76bd62cdca1c6b9f96afed (diff) | |
parent | 474e313d02f0c8f9d821efe720bd5242e700233f (diff) | |
download | rails-aaf01cd53718c8aa5b69ac056b997e6dd9893777.tar.gz rails-aaf01cd53718c8aa5b69ac056b997e6dd9893777.tar.bz2 rails-aaf01cd53718c8aa5b69ac056b997e6dd9893777.zip |
Merge pull request #275 from pk-amooma/master
properly escape "'" to "'" for XML
-rw-r--r-- | activesupport/lib/active_support/core_ext/string/output_safety.rb | 4 | ||||
-rw-r--r-- | activesupport/test/core_ext/string_ext_test.rb | 12 |
2 files changed, 14 insertions, 2 deletions
diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb index c27cbc37c5..6f410819ba 100644 --- a/activesupport/lib/active_support/core_ext/string/output_safety.rb +++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb @@ -3,7 +3,7 @@ require 'active_support/core_ext/kernel/singleton_class' class ERB module Util - HTML_ESCAPE = { '&' => '&', '>' => '>', '<' => '<', '"' => '"' } + XML_ESCAPE = { '&' => '&', '>' => '>', '<' => '<', '"' => '"', "'" => ''' } JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' } # A utility method for escaping HTML tag characters. @@ -20,7 +20,7 @@ class ERB if s.html_safe? s else - s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe + s.gsub(/[&"'><]/) { |special| XML_ESCAPE[special] }.html_safe end end diff --git a/activesupport/test/core_ext/string_ext_test.rb b/activesupport/test/core_ext/string_ext_test.rb index 32675c884a..54ef68c59b 100644 --- a/activesupport/test/core_ext/string_ext_test.rb +++ b/activesupport/test/core_ext/string_ext_test.rb @@ -387,6 +387,18 @@ class OutputSafetyTest < ActiveSupport::TestCase assert !@other_combination.html_safe? end + test "Escapes special HTML/XML characters" do + @other_string = "other".html_safe + @combination = @other_string + "<foo>&\"'" + @other_combination = @string + "<foo>&\"'" + + assert_equal "other<foo>&"'", @combination + assert_equal "hello<foo>&\"'", @other_combination + + assert @combination.html_safe? + assert !@other_combination.html_safe? + end + test "Concatting safe onto unsafe yields unsafe" do @other_string = "other" |