diff options
| author | Michael Koziarski <michael@koziarski.com> | 2013-12-02 10:12:47 +1300 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-12-02 16:41:14 -0800 |
| commit | b31a7a6f1ec3c74f75b4cd12386b08295287418d (patch) | |
| tree | b76118ab77470679d0e4d4df43f7a3957c001b6b /actionview/test/template/number_helper_test.rb | |
| parent | 2e3c3a87d81e16a2fed442c1cf31360f75737a83 (diff) | |
| download | rails-b31a7a6f1ec3c74f75b4cd12386b08295287418d.tar.gz rails-b31a7a6f1ec3c74f75b4cd12386b08295287418d.tar.bz2 rails-b31a7a6f1ec3c74f75b4cd12386b08295287418d.zip | |
Escape the unit value provided to number_to_currency
Previously the unit values were trusted leading to potential XSS vulnerabilities.
Fixes: CVE-2013-6415
Diffstat (limited to 'actionview/test/template/number_helper_test.rb')
| -rw-r--r-- | actionview/test/template/number_helper_test.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/actionview/test/template/number_helper_test.rb b/actionview/test/template/number_helper_test.rb index 6e640889d2..be336ea3fb 100644 --- a/actionview/test/template/number_helper_test.rb +++ b/actionview/test/template/number_helper_test.rb @@ -14,7 +14,8 @@ class NumberHelperTest < ActionView::TestCase assert_equal nil, number_to_currency(nil) assert_equal "$1,234,567,890.50", number_to_currency(1234567890.50) assert_equal "$1,234,567,892", number_to_currency(1234567891.50, precision: 0) - assert_equal "1,234,567,890.50 - Kč", number_to_currency("-1234567890.50", unit: "Kč", format: "%n %u", negative_format: "%n - %u") + assert_equal "1,234,567,890.50 - Kč", number_to_currency("-1234567890.50", unit: raw("Kč"), format: "%n %u", negative_format: "%n - %u") + assert_equal "&pound;1,234,567,890.50", number_to_currency("1234567890.50", unit: "£") end def test_number_to_percentage |