diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-08 15:10:35 -0700 |
|---|---|---|
| committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 15:48:17 -0300 |
| commit | 6d0526db91afb0675c2ad3d871529d1536303c64 (patch) | |
| tree | 81bff482a5ddd39587c738e6326c20e639eaa1d6 /actionpack/lib/action_view/helpers | |
| parent | 65b5e35e898ac09a50b61c671d98a3cf92453003 (diff) | |
| download | rails-6d0526db91afb0675c2ad3d871529d1536303c64.tar.gz rails-6d0526db91afb0675c2ad3d871529d1536303c64.tar.bz2 rails-6d0526db91afb0675c2ad3d871529d1536303c64.zip | |
escape select_tag :prompt values
CVE-2012-3463
Diffstat (limited to 'actionpack/lib/action_view/helpers')
| -rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 066b98d4a2..9e0ec17836 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -122,11 +122,11 @@ module ActionView html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name if options.delete(:include_blank) - option_tags = "<option value=\"\"></option>".html_safe + option_tags + option_tags = content_tag(:option, '', :value => '').safe_concat(option_tags) end if prompt = options.delete(:prompt) - option_tags = "<option value=\"\">#{prompt}</option>".html_safe + option_tags + option_tags = content_tag(:option, prompt, :value => '').safe_concat(option_tags) end content_tag :select, option_tags, { "name" => html_name, "id" => sanitize_to_id(name) }.update(options.stringify_keys) |