diff options
author | Andrew White <andyw@pixeltrix.co.uk> | 2010-06-26 01:54:13 +0100 |
---|---|---|
committer | Jeremy Kemper <jeremy@bitsweat.net> | 2010-06-25 18:05:40 -0700 |
commit | bba19603c27e0439eb22a9bce7e3adf6924b224b (patch) | |
tree | 429cae57c7d546e0bdafd96e70c1a0db3e85273f | |
parent | 6e655732226eef6fa04d8fc0c4ee1f0436688c49 (diff) | |
download | rails-bba19603c27e0439eb22a9bce7e3adf6924b224b.tar.gz rails-bba19603c27e0439eb22a9bce7e3adf6924b224b.tar.bz2 rails-bba19603c27e0439eb22a9bce7e3adf6924b224b.zip |
URL fragments should not have safe characters escaped. Ref: Appendix A, http://tools.ietf.org/rfc/rfc3986.txt
[#4762 state:resolved]
Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net>
-rw-r--r-- | actionpack/lib/action_dispatch/routing/route_set.rb | 2 | ||||
-rw-r--r-- | actionpack/test/controller/url_for_test.rb | 12 |
2 files changed, 10 insertions, 4 deletions
diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb index 57a73dde75..97fe137633 100644 --- a/actionpack/lib/action_dispatch/routing/route_set.rb +++ b/actionpack/lib/action_dispatch/routing/route_set.rb @@ -447,7 +447,7 @@ module ActionDispatch # ROUTES TODO: This can be called directly, so script_name should probably be set in the router rewritten_url << (options[:trailing_slash] ? path.sub(/\?|\z/) { "/" + $& } : path) - rewritten_url << "##{Rack::Utils.escape(options[:anchor].to_param.to_s)}" if options[:anchor] + rewritten_url << "##{Rack::Mount::Utils.escape_uri(options[:anchor].to_param.to_s)}" if options[:anchor] rewritten_url end diff --git a/actionpack/test/controller/url_for_test.rb b/actionpack/test/controller/url_for_test.rb index 907acf9573..4b30b0af36 100644 --- a/actionpack/test/controller/url_for_test.rb +++ b/actionpack/test/controller/url_for_test.rb @@ -34,9 +34,15 @@ module AbstractController ) end - def test_anchor_should_be_cgi_escaped - assert_equal('/c/a#anc%2Fhor', - W.new.url_for(:only_path => true, :controller => 'c', :action => 'a', :anchor => Struct.new(:to_param).new('anc/hor')) + def test_anchor_should_escape_unsafe_pchar + assert_equal('/c/a#%23anchor', + W.new.url_for(:only_path => true, :controller => 'c', :action => 'a', :anchor => Struct.new(:to_param).new('#anchor')) + ) + end + + def test_anchor_should_not_escape_safe_pchar + assert_equal('/c/a#name=user&email=user@domain.com', + W.new.url_for(:only_path => true, :controller => 'c', :action => 'a', :anchor => Struct.new(:to_param).new('name=user&email=user@domain.com')) ) end |