diff options
author | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-08 15:10:35 -0700 |
---|---|---|
committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 15:48:17 -0300 |
commit | 6d0526db91afb0675c2ad3d871529d1536303c64 (patch) | |
tree | 81bff482a5ddd39587c738e6326c20e639eaa1d6 /actionpack/test/template | |
parent | 65b5e35e898ac09a50b61c671d98a3cf92453003 (diff) | |
download | rails-6d0526db91afb0675c2ad3d871529d1536303c64.tar.gz rails-6d0526db91afb0675c2ad3d871529d1536303c64.tar.bz2 rails-6d0526db91afb0675c2ad3d871529d1536303c64.zip |
escape select_tag :prompt values
CVE-2012-3463
Diffstat (limited to 'actionpack/test/template')
-rw-r--r-- | actionpack/test/template/form_tag_helper_test.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb index 68dfceef07..6f0d0c3561 100644 --- a/actionpack/test/template/form_tag_helper_test.rb +++ b/actionpack/test/template/form_tag_helper_test.rb @@ -208,6 +208,12 @@ class FormTagHelperTest < ActionView::TestCase assert_dom_equal expected, actual end + def test_select_tag_escapes_prompt + actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>" + expected = %(<select id="places" name="places"><option value=""><script>alert(1337)</script></option><option>Home</option><option>Work</option><option>Pub</option></select>) + assert_dom_equal expected, actual + end + def test_select_tag_with_prompt_and_include_blank actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>) |