Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Adding a missing parenthesis in the doc of String#parameterize. | Geoffrey Roguelon | 2012-10-24 | 1 | -1/+1 |
| | |||||
* | Fix html_escape with Ruby 1.8 | Rafael Mendonça França | 2012-08-02 | 1 | -15/+26 |
| | |||||
* | html_escape should escape single quotes | Santiago Pastorino | 2012-08-02 | 1 | -28/+16 |
| | | | | | | | | | | | | https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content Closes #7215 Conflicts: actionpack/test/template/erb_util_test.rb actionpack/test/template/form_tag_helper_test.rb actionpack/test/template/text_helper_test.rb actionpack/test/template/url_helper_test.rb activesupport/lib/active_support/core_ext/string/output_safety.rb | ||||
* | adding examples and docs | Francesco Rodriguez | 2012-05-12 | 2 | -1/+18 |
| | |||||
* | Stop SafeBuffer#clone_empty from issuing warnings | Carlos Antonio da Silva | 2012-03-02 | 1 | -3/+1 |
| | | | | | | | | | | | | Logic in clone_empty method was dealing with old @dirty variable, which has changed by @html_safe in this commit: https://github.com/rails/rails/commit/139963c99a955520db6373343662e55f4d16dcd1 This was issuing a "not initialized variable" warning - related to: https://github.com/rails/rails/pull/5237 The logic applied by this method is already handled by the [] override, so there is no need to reset the variable here. | ||||
* | Ensure [] respects the status of the buffer. | José Valim | 2012-02-29 | 1 | -12/+18 |
| | |||||
* | delete vulnerable AS::SafeBuffer#[] | Akira Matsuda | 2012-02-20 | 1 | -6/+0 |
| | |||||
* | add AS::SafeBuffer#clone_empty | Akira Matsuda | 2012-02-20 | 1 | -0/+6 |
| | |||||
* | Change ActiveRecord::Errors to ActiveModel::Errors in guides | Carlos Antonio da Silva | 2012-01-25 | 1 | -2/+2 |
| | | | | | | | Use ActiveModel::Errors in inflection example docs as well. Also fixes wrong information and link to locale file related to Errors#full_messages in I18n guide. | ||||
* | Remove duplicate html_escape docs | Jeremy Kemper | 2011-12-11 | 1 | -10/+1 |
| | |||||
* | Use 1.9 native XML escaping to speed up html_escape and shush regexp warnings | Jeremy Kemper | 2011-12-11 | 1 | -15/+36 |
| | | | | | | | | | | | | length user system total real before 6 0.010000 0.000000 0.010000 ( 0.012378) after 6 0.010000 0.000000 0.010000 ( 0.012866) before 60 0.040000 0.000000 0.040000 ( 0.046273) after 60 0.040000 0.000000 0.040000 ( 0.036421) before 600 0.390000 0.000000 0.390000 ( 0.390670) after 600 0.210000 0.000000 0.210000 ( 0.209094) before 6000 3.750000 0.000000 3.750000 ( 3.751008) after 6000 1.860000 0.000000 1.860000 ( 1.857901) | ||||
* | fix nodocs | Vijay Dev | 2011-12-09 | 1 | -1/+1 |
| | |||||
* | Restore performance of ERB::Util.html_escape | Jon Jensen | 2011-12-03 | 1 | -1/+1 |
| | | | | | | | Revert html_escape to do a single gsub again, but add the "n" flag (no language, i.e. not multi-byte) to protect against XSS via invalid utf8 Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | fixes a typo (thanks to Alexey Vakhov) | Xavier Noria | 2011-10-30 | 1 | -1/+1 |
| | |||||
* | defines Module#qualified_const_(defined?|get|set) and String#deconstantize | Xavier Noria | 2011-10-29 | 1 | -0/+15 |
| | | | | | | | | | | This commit also implements a faster version of #demodulize I was unable to isolate with git add --patch. Not a big fan of the name #deconstantize. It complements #demodulize getting rid of the rightmost constant, hence the name, but it is unrelated to the well-known #constantize. So unsure. Could not come with anything better, please feel free to rename. | ||||
* | Merge pull request #3151 from zenprogrammer/pluralize_without_count | José Valim | 2011-10-17 | 1 | -3/+14 |
|\ | | | | | Added include_count parameter to pluralize. | ||||
| * | Modified String#pluralize to take an optional count parameter. | Ryan Oblak | 2011-09-28 | 1 | -3/+14 |
| | | |||||
* | | ruby193: String#prepend is also unsafe | Akira Matsuda | 2011-10-05 | 1 | -1/+1 |
| | | |||||
* | | override unsafe methods only if defined on String | Akira Matsuda | 2011-10-05 | 1 | -10/+12 |
|/ | |||||
* | remove superfluous to_s in ERB::Util.html_escape | Alexey Vakhov | 2011-09-24 | 1 | -1/+1 |
| | |||||
* | Minor doc fix to String#constantize | Ryan Oblak | 2011-09-23 | 1 | -3/+3 |
| | |||||
* | Added ActiveSupport::Inflector.safe_constantize and String#safe_constantize; ↵ | Ryan Oblak | 2011-09-23 | 1 | -3/+16 |
| | | | | refactored common constantize tests into ConstantizeTestCases | ||||
* | fix incorrect comment | Vijay Dev | 2011-09-22 | 1 | -1/+1 |
| | |||||
* | Proper lines numbers for stack trace info | Santiago Pastorino | 2011-09-16 | 1 | -1/+1 |
| | |||||
* | revert the changes from c60995f3 - related to marking sub,gsub as ↵ | Vijay Dev | 2011-09-09 | 1 | -20/+1 |
| | | | | unavailable to use with safe strings | ||||
* | Revert removing gsub and sub from safe buffer. | José Valim | 2011-09-08 | 1 | -3/+3 |
| | |||||
* | this should have gone with the previous commit | Xavier Noria | 2011-09-08 | 1 | -4/+4 |
| | |||||
* | copy-edits a couple of exception messages | Xavier Noria | 2011-09-08 | 1 | -4/+4 |
| | | | | | | | "Safe Buffer" should either be the constant with the class name, or go in lower case. I've chosen to follow the same terminology that is used in the AS core extensiong guide, "safe string", though "safe buffer" is also used elsewhere, we should pick one. | ||||
* | better method documentation on disable safe string methods | Damien Mathieu | 2011-09-08 | 1 | -6/+12 |
| | |||||
* | make gsub and sub unavailable in SafeBuffers - Closes #1555 | Damien Mathieu | 2011-09-08 | 1 | -3/+16 |
| | |||||
* | properly escape html to avoid invalid utf8 causing XSS attacks | Aaron Patterson | 2011-08-16 | 1 | -1/+1 |
| | |||||
* | Reset @dirty to false when slicing an instance of SafeBuffer | Brian Cardarella | 2011-07-29 | 1 | -0/+6 |
| | |||||
* | Merge branch 'master' of git://github.com/lifo/docrails | Xavier Noria | 2011-07-24 | 1 | -1/+1 |
|\ | |||||
| * | Changed a few instances of of words in the API docs written in British ↵ | Oemuer Oezkir | 2011-07-24 | 1 | -1/+1 |
| | | | | | | | | | | | | English to American English(according to Weber) | ||||
* | | adds a couple of missing magic comments [fixes #1374] | Xavier Noria | 2011-07-23 | 1 | -0/+1 |
|/ | |||||
* | Merge pull request #1463 from psanford/master | Santiago Pastorino | 2011-07-06 | 1 | -2/+2 |
|\ | | | | | Fix timezone handling in String.to_time | ||||
| * | Make String.to_time respect timezones | Nate Mueller | 2011-06-02 | 1 | -2/+2 |
| | | |||||
* | | Merge branch 'master' of git://github.com/lifo/docrails | Xavier Noria | 2011-07-05 | 1 | -8/+8 |
|\ \ | |||||
| * | | document meta methods | Vijay Dev | 2011-07-03 | 1 | -8/+8 |
| | | | |||||
* | | | all numerics should be html_safe - Closes #1935 | Damien Mathieu | 2011-07-03 | 1 | -1/+1 |
| | | | |||||
* | | | Merge pull request #1648 from dlee/acronyms | Xavier Noria | 2011-06-24 | 1 | -1/+0 |
|\ \ \ | |/ / |/| | | Inflector support for acronyms (Issue #1366) | ||||
| * | | Refactor | David Lee | 2011-06-11 | 1 | -1/+0 |
| | | | |||||
* | | | calling unsafe methods which don't return a string shouldn't fail | Damien Mathieu | 2011-06-22 | 1 | -2/+2 |
| | | | |||||
* | | | safe_concat should not work on dirty buffers. | José Valim | 2011-06-16 | 1 | -4/+13 |
| | | | |||||
* | | | Fix safe buffer by adding a dirty status. | José Valim | 2011-06-16 | 1 | -12/+24 |
| | | | |||||
* | | | Define ActiveSupport#to_param as to_str - closes #1663 | Andrew White | 2011-06-12 | 1 | -0/+4 |
|/ / | |||||
* | | ensuring that json_escape returns html safe strings when passed an html safe ↵ | Aaron Patterson | 2011-06-09 | 1 | -1/+2 |
| | | | | | | | | string | ||||
* | | Prefer 'each' over 'for in' syntax. | Sebastian Martinez | 2011-06-07 | 1 | -1/+1 |
| | | |||||
* | | Ensure that the strings returned by SafeBuffer#gsub and friends aren't ↵ | Michael Koziarski | 2011-06-07 | 1 | -0/+13 |
|/ | | | | | | | | | | considered html_safe? Also make sure that the versions of those methods which modify a string in place such as gsub! can't be called on safe buffers at all. Conflicts: activesupport/test/safe_buffer_test.rb | ||||
* | minor fixes | Vijay Dev | 2011-05-07 | 3 | -4/+3 |
| |