diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2011-08-16 15:18:53 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2011-08-16 15:24:58 -0700 |
| commit | bfc432574d0b141fd7fe759edfe9b6771dd306bd (patch) | |
| tree | 17ebd530a798128910f56c0b9dddd2202726ed8b /activesupport/lib/active_support/core_ext/string/output_safety.rb | |
| parent | 586a944ddd4d03e66dea1093306147594748037a (diff) | |
| download | rails-bfc432574d0b141fd7fe759edfe9b6771dd306bd.tar.gz rails-bfc432574d0b141fd7fe759edfe9b6771dd306bd.tar.bz2 rails-bfc432574d0b141fd7fe759edfe9b6771dd306bd.zip | |
properly escape html to avoid invalid utf8 causing XSS attacks
Diffstat (limited to 'activesupport/lib/active_support/core_ext/string/output_safety.rb')
| -rw-r--r-- | activesupport/lib/active_support/core_ext/string/output_safety.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb index 6d6c4912bb..f111c8e5a3 100644 --- a/activesupport/lib/active_support/core_ext/string/output_safety.rb +++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb @@ -20,7 +20,7 @@ class ERB if s.html_safe? s else - s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe + s.to_s.gsub(/&/, "&").gsub(/\"/, """).gsub(/>/, ">").gsub(/</, "<").html_safe end end |