truncate() should not try to produce HTML-safe output

As discussed in Lighthouse ticket #4825 and ticket #4878, the truncate()
method cannot guarantee safe output for all possible inputs/offsets, so
it is best to leave the output unsafe so that it gets escaped when used
in a view.

Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>
Signed-off-by: David Heinemeier Hansson <david@loudthinking.com>

1 files changed, 4 insertions, 14 deletions

diff --git a/actionpack/test/template/text_helper_test.rb b/actionpack/test/template/text_helper_test.rb
index b0a4c2a9cc..1cd6a5941d 100644
--- a/actionpack/test/template/text_helper_test.rb
+++ b/actionpack/test/template/text_helper_test.rb
@@ -52,8 +52,8 @@ class TextHelperTest < ActionView::TestCase
     assert_equal "<p><b> test with safe string </b></p>", simple_format("<b> test with safe string </b>".html_safe)
   end
 
-  def test_truncate_should_be_html_safe
-    assert truncate("Hello World!", :length => 12).html_safe?
+  def test_truncate_should_not_be_html_safe
+    assert !truncate("Hello World!", :length => 12).html_safe?
   end
   
   def test_truncate
@@ -61,18 +61,8 @@ class TextHelperTest < ActionView::TestCase
     assert_equal "Hello Wor...", truncate("Hello World!!", :length => 12)
   end
 
-  def test_truncate_should_escape_unsafe_input
-    assert_equal "Hello &lt...", truncate("Hello <script>code!</script>World!!", :length => 12)
-  end
-
-  def test_truncate_should_not_escape_input_if_safe_option
-    assert_equal "Hello <sc...", truncate("Hello <script>code!</script>World!", :length => 12, :safe => true)
-    assert_equal "Hello <sc...", truncate("Hello <script>code!</script>World!!", :length => 12, :safe => true)
-  end
-
-  def test_truncate_should_not_escape_safe_input
-    assert_equal "Hello <sc...", truncate("Hello <script>code!</script>World!".html_safe, :length => 12)
-    assert_equal "Hello <sc...", truncate("Hello <script>code!</script>World!!".html_safe, :length => 12)
+  def test_truncate_should_not_escape_input
+    assert_equal "Hello <sc...", truncate("Hello <script>code!</script>World!!", :length => 12)
   end
 
   def test_truncate_should_use_default_length_of_30