From 958daaa664079ec32e542dc3dec52dfd504aecde Mon Sep 17 00:00:00 2001 From: Andrew White Date: Sun, 29 Apr 2012 21:09:49 +0100 Subject: Escape interpolated params when redirecting - fixes #5688 --- actionpack/lib/action_dispatch/routing/redirection.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'actionpack/lib/action_dispatch') diff --git a/actionpack/lib/action_dispatch/routing/redirection.rb b/actionpack/lib/action_dispatch/routing/redirection.rb index ae01781013..f4084d9f4f 100644 --- a/actionpack/lib/action_dispatch/routing/redirection.rb +++ b/actionpack/lib/action_dispatch/routing/redirection.rb @@ -1,4 +1,5 @@ require 'action_dispatch/http/request' +require 'rack/utils' module ActionDispatch module Routing @@ -96,13 +97,18 @@ module ActionDispatch path = args.shift block = lambda { |params, request| - (params.empty? || !path.match(/%\{\w*\}/)) ? path : (path % params) + (params.empty? || !path.match(/%\{\w*\}/)) ? path : (path % escape(params)) } if String === path block = path if path.respond_to? :call raise ArgumentError, "redirection argument not supported" unless block Redirect.new status, block end + + private + def escape(params) + Hash[params.map{ |k,v| [k, Rack::Utils.escape(v)] }] + end end end end -- cgit v1.2.3