diff options
| author | David Heinemeier Hansson <david@loudthinking.com> | 2010-02-12 17:24:04 -0800 |
|---|---|---|
| committer | David Heinemeier Hansson <david@loudthinking.com> | 2010-02-12 17:24:04 -0800 |
| commit | d68f8ba5c303556ecb8625dd146184d68b704e83 (patch) | |
| tree | bd0360f2f04c1a732c24687afed0366d38a5d5fc /actionpack/lib/action_view | |
| parent | 325fa58ef585b4303a41270e231918f298ee30bd (diff) | |
| download | rails-d68f8ba5c303556ecb8625dd146184d68b704e83.tar.gz rails-d68f8ba5c303556ecb8625dd146184d68b704e83.tar.bz2 rails-d68f8ba5c303556ecb8625dd146184d68b704e83.zip | |
simple_format returns a safe buffer escaping unsafe input [Santiago Pastorino]
Diffstat (limited to 'actionpack/lib/action_view')
| -rw-r--r-- | actionpack/lib/action_view/helpers/text_helper.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb index d84515d5b5..b19a9754f4 100644 --- a/actionpack/lib/action_view/helpers/text_helper.rb +++ b/actionpack/lib/action_view/helpers/text_helper.rb @@ -327,7 +327,7 @@ module ActionView # # => "<p class='description'>Look ma! A class!</p>" def simple_format(text, html_options={}) start_tag = tag('p', html_options, true) - text = text.to_s.dup + text = h(text) text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n text.gsub!(/\n\n+/, "</p>\n\n#{start_tag}") # 2+ newline -> paragraph text.gsub!(/([^\n]\n)(?=[^\n])/, '\1<br />') # 1 newline -> br |