diff options
| author | Jon Jensen <jenseng@gmail.com> | 2011-12-02 12:55:33 -0700 |
|---|---|---|
| committer | José Valim <jose.valim@gmail.com> | 2011-12-03 10:36:52 +0100 |
| commit | 0e17cf17ebeb70490d7c7cd25c6bf8f9401e44b3 (patch) | |
| tree | b1cf0dc4056526df4db2ebfdb8e3fc735ac3939a /activesupport/lib | |
| parent | 9ac6310bd988f19b02e375f1f9594df4d469f624 (diff) | |
| download | rails-0e17cf17ebeb70490d7c7cd25c6bf8f9401e44b3.tar.gz rails-0e17cf17ebeb70490d7c7cd25c6bf8f9401e44b3.tar.bz2 rails-0e17cf17ebeb70490d7c7cd25c6bf8f9401e44b3.zip | |
Restore performance of ERB::Util.html_escape
Revert html_escape to do a single gsub again, but add the "n" flag (no
language, i.e. not multi-byte) to protect against XSS via invalid utf8
Signed-off-by: José Valim <jose.valim@gmail.com>
Diffstat (limited to 'activesupport/lib')
| -rw-r--r-- | activesupport/lib/active_support/core_ext/string/output_safety.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb index 5d7f74bb65..7b359a039b 100644 --- a/activesupport/lib/active_support/core_ext/string/output_safety.rb +++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb @@ -20,7 +20,7 @@ class ERB if s.html_safe? s else - s.gsub(/&/, "&").gsub(/\"/, """).gsub(/>/, ">").gsub(/</, "<").html_safe + s.gsub(/[&"><]/n) { |special| HTML_ESCAPE[special] }.html_safe end end |