From 02358c83b76f9fc56b6cabaee24b244d17d08cff Mon Sep 17 00:00:00 2001 From: Rick Olson Date: Wed, 18 Oct 2006 15:58:07 +0000 Subject: Fix double-escaped entities, such as &amp;, &#123;, etc. [Rick] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5321 5ecf4fe2-1ee6-0310-87b1-e25e094e27de --- actionpack/CHANGELOG | 2 ++ actionpack/lib/action_view/helpers/tag_helper.rb | 7 ++++++- actionpack/test/template/tag_helper_test.rb | 12 ++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG index 91b786eb59..1993fcf41c 100644 --- a/actionpack/CHANGELOG +++ b/actionpack/CHANGELOG @@ -1,5 +1,7 @@ *SVN* +* Fix double-escaped entities, such as &amp;, &#123;, etc. [Rick] + * Fix deprecation warnings when rendering the template error template. [Nicholas Seckar] * Fix routing to correctly determine when generation fails. Closes #6300. [psross]. diff --git a/actionpack/lib/action_view/helpers/tag_helper.rb b/actionpack/lib/action_view/helpers/tag_helper.rb index 6c71b8b767..6001b21e63 100644 --- a/actionpack/lib/action_view/helpers/tag_helper.rb +++ b/actionpack/lib/action_view/helpers/tag_helper.rb @@ -34,7 +34,7 @@ module ActionView private def tag_options(options) cleaned_options = convert_booleans(options.stringify_keys.reject {|key, value| value.nil?}) - ' ' + cleaned_options.map {|key, value| %(#{key}="#{html_escape(value.to_s)}")}.sort * ' ' unless cleaned_options.empty? + ' ' + cleaned_options.map {|key, value| %(#{key}="#{fix_double_escape(html_escape(value.to_s))}")}.sort * ' ' unless cleaned_options.empty? end def convert_booleans(options) @@ -45,6 +45,11 @@ module ActionView def boolean_attribute(options, attribute) options[attribute] ? options[attribute] = attribute : options.delete(attribute) end + + # Fix double-escaped entities, such as &amp;, &#123;, etc. + def fix_double_escape(escaped) + escaped.gsub(/&([a-z]+|(#\d+));/i) { "&#{$1};" } + end end end end diff --git a/actionpack/test/template/tag_helper_test.rb b/actionpack/test/template/tag_helper_test.rb index b45be96959..8611f4c9bd 100644 --- a/actionpack/test/template/tag_helper_test.rb +++ b/actionpack/test/template/tag_helper_test.rb @@ -38,4 +38,16 @@ class TagHelperTest < Test::Unit::TestCase def test_cdata_section assert_equal "]]>", cdata_section("") end + + def test_double_escaping_attributes + ['1&2', '1 < 2', '“test“'].each do |escaped| + assert_equal %(), tag('a', :href => escaped) + end + end + + def test_skip_invalid_escaped_attributes + ['&1;', 'dfa3;', '& #123;'].each do |escaped| + assert_equal %(), tag('a', :href => escaped) + end + end end -- cgit v1.2.3