diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-03 02:40:09 -0300 |
|---|---|---|
| committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-03 10:00:55 -0300 |
| commit | c8a613b978df82aad8620f109b40f6027cb897a8 (patch) | |
| tree | 12ae4b7d87c75e985ded953ef23704150b182d34 | |
| parent | 8f8d8eb1465069e2ed9b6f2404aa9d02e785f534 (diff) | |
| download | rails-c8a613b978df82aad8620f109b40f6027cb897a8.tar.gz rails-c8a613b978df82aad8620f109b40f6027cb897a8.tar.bz2 rails-c8a613b978df82aad8620f109b40f6027cb897a8.zip | |
Add test select_tag escapes prompt
| -rw-r--r-- | actionpack/test/template/form_tag_helper_test.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb index 1f4f693b13..dcae5b2352 100644 --- a/actionpack/test/template/form_tag_helper_test.rb +++ b/actionpack/test/template/form_tag_helper_test.rb @@ -213,6 +213,12 @@ class FormTagHelperTest < ActionView::TestCase assert_dom_equal expected, actual end + def test_select_tag_escapes_prompt + actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>" + expected = %(<select id="places" name="places"><option value=""><script>alert(1337)</script></option><option>Home</option><option>Work</option><option>Pub</option></select>) + assert_dom_equal expected, actual + end + def test_select_tag_with_prompt_and_include_blank actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>) |