diff options
| author | Wincent Colaiuta <win@wincent.com> | 2010-06-17 08:39:13 +0200 |
|---|---|---|
| committer | David Heinemeier Hansson <david@loudthinking.com> | 2010-06-17 09:41:04 -0500 |
| commit | a424808df95c5ebe66d02f0d743e741a1864baa7 (patch) | |
| tree | 8d42d5ea86e0fba2e04922fb233271bd903a89db /actionpack/lib/action_view | |
| parent | 69bc8b26a9be246acc06eaab09063eb97f76aa00 (diff) | |
| download | rails-a424808df95c5ebe66d02f0d743e741a1864baa7.tar.gz rails-a424808df95c5ebe66d02f0d743e741a1864baa7.tar.bz2 rails-a424808df95c5ebe66d02f0d743e741a1864baa7.zip | |
truncate() should not try to produce HTML-safe output
As discussed in Lighthouse ticket #4825 and ticket #4878, the truncate()
method cannot guarantee safe output for all possible inputs/offsets, so
it is best to leave the output unsafe so that it gets escaped when used
in a view.
Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>
Signed-off-by: David Heinemeier Hansson <david@loudthinking.com>
Diffstat (limited to 'actionpack/lib/action_view')
| -rw-r--r-- | actionpack/lib/action_view/helpers/text_helper.rb | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb index 3b37fd6b57..654f3c89f3 100644 --- a/actionpack/lib/action_view/helpers/text_helper.rb +++ b/actionpack/lib/action_view/helpers/text_helper.rb @@ -39,7 +39,10 @@ module ActionView # for a total length not exceeding <tt>:length</tt>. # # Pass a <tt>:separator</tt> to truncate +text+ at a natural break. - # Pass a <tt>:safe</tt> value as "true" to not to escape the content. + # + # The result is not marked as HTML-safe, so will be subject to the default escaping when + # used in views, unless wrapped by <tt>raw()</tt>. Care should be taken if +text+ contains HTML tags + # or entities, because truncation may produce invalid HTML (such as unbalanced or incomplete tags). # # ==== Examples # @@ -56,12 +59,6 @@ module ActionView # # => "And they f... (continued)" # # truncate("<p>Once upon a time in a world far far away</p>") - # # => "<p>Once upon a time i..." - # - # truncate("<p>Once upon a time in a world far far away</p>", :safe => true) - # # => "<p>Once upon a time in a wo..." - # - # truncate("<p>Once upon a time in a world far far away</p>".html_safe) # # => "<p>Once upon a time in a wo..." # # You can still use <tt>truncate</tt> with the old API that accepts the @@ -84,7 +81,6 @@ module ActionView options.reverse_merge!(:length => 30) - text = h(text) unless text.html_safe? || options[:safe] text.truncate(options.delete(:length), options) if text end |