Switch to on-by-default XSS escaping for rails.

  This consists of:

  * String#html_safe! a method to mark a string as 'safe'
  * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
  * Calls to String#html_safe! throughout the rails helpers
  * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
  * New ERB implementation based on erubis which uses a SafeBuffer instead of a String

Hat tip to Django for the inspiration.

2 files changed, 20 insertions, 1 deletions

diff --git a/actionpack/test/controller/output_escaping_test.rb b/actionpack/test/controller/output_escaping_test.rb
new file mode 100644
index 0000000000..7332f3f1e3
--- /dev/null
+++ b/actionpack/test/controller/output_escaping_test.rb
@@ -0,0 +1,19 @@
+require 'abstract_unit'
+
+class OutputEscapingTest < ActiveSupport::TestCase
+
+  test "escape_html shouldn't die when passed nil" do
+    assert ERB::Util.h(nil).blank?
+  end
+
+  test "escapeHTML should escape strings" do
+    assert_equal "&lt;&gt;&quot;", ERB::Util.h("<>\"")
+  end
+
+  test "escapeHTML shouldn't touch explicitly safe strings" do
+    # TODO this seems easier to compose and reason about, but
+    # this should be verified
+    assert_equal "<", ERB::Util.h("<".html_safe!)
+  end
+
+end
diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb
index abcc8bf384..2db524ca4b 100644
--- a/actionpack/test/controller/render_test.rb
+++ b/actionpack/test/controller/render_test.rb
@@ -1050,7 +1050,7 @@ class RenderTest < ActionController::TestCase
 
   def test_action_talk_to_layout
     get :action_talk_to_layout
-    assert_equal "<title>Talking to the layout</title>\nAction was here!", @response.body
+    assert_equal "<title>Talking to the layout</title>\n\nAction was here!", @response.body
   end
 
   # :addressed: