diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2012-07-31 22:25:54 -0300 |
|---|---|---|
| committer | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2012-08-02 17:09:37 -0300 |
| commit | 2bdb4ec6ad9bb99ac0029fcb030ac757307d08ae (patch) | |
| tree | 70e5d9cf8bf64b73d60b4798828f8aa59a488236 /actionpack/test/template/javascript_helper_test.rb | |
| parent | 96e92b616264c26a5c1c2a50f0495c119a869772 (diff) | |
| download | rails-2bdb4ec6ad9bb99ac0029fcb030ac757307d08ae.tar.gz rails-2bdb4ec6ad9bb99ac0029fcb030ac757307d08ae.tar.bz2 rails-2bdb4ec6ad9bb99ac0029fcb030ac757307d08ae.zip | |
html_escape should escape single quotes
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
Closes #7215
Conflicts:
actionpack/test/template/erb_util_test.rb
actionpack/test/template/form_tag_helper_test.rb
actionpack/test/template/text_helper_test.rb
actionpack/test/template/url_helper_test.rb
activesupport/lib/active_support/core_ext/string/output_safety.rb
Diffstat (limited to 'actionpack/test/template/javascript_helper_test.rb')
| -rw-r--r-- | actionpack/test/template/javascript_helper_test.rb | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/actionpack/test/template/javascript_helper_test.rb b/actionpack/test/template/javascript_helper_test.rb index 4b9c3c97b1..80a7744a1e 100644 --- a/actionpack/test/template/javascript_helper_test.rb +++ b/actionpack/test/template/javascript_helper_test.rb @@ -46,12 +46,12 @@ class JavaScriptHelperTest < ActionView::TestCase end def test_button_to_function - assert_dom_equal %(<input type="button" onclick="alert('Hello world!');" value="Greeting" />), + assert_dom_equal %(<input type="button" onclick="alert('Hello world!');" value="Greeting" />), button_to_function("Greeting", "alert('Hello world!')") end def test_button_to_function_with_onclick - assert_dom_equal "<input onclick=\"alert('Goodbye World :('); alert('Hello world!');\" type=\"button\" value=\"Greeting\" />", + assert_dom_equal "<input onclick=\"alert('Goodbye World :('); alert('Hello world!');\" type=\"button\" value=\"Greeting\" />", button_to_function("Greeting", "alert('Hello world!')", :onclick => "alert('Goodbye World :(')") end @@ -61,17 +61,17 @@ class JavaScriptHelperTest < ActionView::TestCase end def test_link_to_function - assert_dom_equal %(<a href="#" onclick="alert('Hello world!'); return false;">Greeting</a>), + assert_dom_equal %(<a href="#" onclick="alert('Hello world!'); return false;">Greeting</a>), link_to_function("Greeting", "alert('Hello world!')") end def test_link_to_function_with_existing_onclick - assert_dom_equal %(<a href="#" onclick="confirm('Sanity!'); alert('Hello world!'); return false;">Greeting</a>), + assert_dom_equal %(<a href="#" onclick="confirm('Sanity!'); alert('Hello world!'); return false;">Greeting</a>), link_to_function("Greeting", "alert('Hello world!')", :onclick => "confirm('Sanity!')") end def test_function_with_href - assert_dom_equal %(<a href="http://example.com/" onclick="alert('Hello world!'); return false;">Greeting</a>), + assert_dom_equal %(<a href="http://example.com/" onclick="alert('Hello world!'); return false;">Greeting</a>), link_to_function("Greeting", "alert('Hello world!')", :href => 'http://example.com/') end |