diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2012-07-31 22:25:54 -0300 |
|---|---|---|
| committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-02 17:14:30 -0300 |
| commit | 28f2c6f4037081da0a82104a3f473165ed4ed2ce (patch) | |
| tree | a511eac32c29cf7f9612b6691ac15ac558c5bd77 /actionpack/test/template/form_options_helper_test.rb | |
| parent | 9c1b1bd42ce00d43b7894daaf096eff9ee55aef1 (diff) | |
| download | rails-28f2c6f4037081da0a82104a3f473165ed4ed2ce.tar.gz rails-28f2c6f4037081da0a82104a3f473165ed4ed2ce.tar.bz2 rails-28f2c6f4037081da0a82104a3f473165ed4ed2ce.zip | |
html_escape should escape single quotes
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
Closes #7215
Conflicts:
actionpack/test/template/erb_util_test.rb
actionpack/test/template/form_tag_helper_test.rb
actionpack/test/template/text_helper_test.rb
actionpack/test/template/url_helper_test.rb
activesupport/lib/active_support/core_ext/string/output_safety.rb
Diffstat (limited to 'actionpack/test/template/form_options_helper_test.rb')
| -rw-r--r-- | actionpack/test/template/form_options_helper_test.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/actionpack/test/template/form_options_helper_test.rb b/actionpack/test/template/form_options_helper_test.rb index 09b1bd3884..3009fa5330 100644 --- a/actionpack/test/template/form_options_helper_test.rb +++ b/actionpack/test/template/form_options_helper_test.rb @@ -1011,7 +1011,7 @@ class FormOptionsHelperTest < ActionView::TestCase def test_options_for_select_with_element_attributes assert_dom_equal( - "<option value=\"<Denmark>\" class=\"bold\"><Denmark></option>\n<option value=\"USA\" onclick=\"alert('Hello World');\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>", + "<option value=\"<Denmark>\" class=\"bold\"><Denmark></option>\n<option value=\"USA\" onclick=\"alert('Hello World');\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>", options_for_select([ [ "<Denmark>", { :class => 'bold' } ], [ "USA", { :onclick => "alert('Hello World');" } ], [ "Sweden" ], "Germany" ]) ) end @@ -1047,13 +1047,13 @@ class FormOptionsHelperTest < ActionView::TestCase def test_option_html_attributes_with_multiple_element_hash output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy', 'onclick' => "alert('Hello World');" } ]) assert output.include?(" class=\"fancy\"") - assert output.include?(" onclick=\"alert('Hello World');\"") + assert output.include?(" onclick=\"alert('Hello World');\"") end def test_option_html_attributes_with_multiple_hashes output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy' }, { 'onclick' => "alert('Hello World');" } ]) assert output.include?(" class=\"fancy\"") - assert output.include?(" onclick=\"alert('Hello World');\"") + assert output.include?(" onclick=\"alert('Hello World');\"") end def test_option_html_attributes_with_special_characters |