From 5ffa69793fd3e1d4af41ebc719a6736163eb7433 Mon Sep 17 00:00:00 2001
From: Alexey Vakhov <vakhov@gmail.com>
Date: Sun, 25 Sep 2011 09:40:49 +0400
Subject: escape options for the stylesheet_link_tag method

---
 .../action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb   | 2 +-
 actionpack/test/template/asset_tag_helper_test.rb                     | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

(limited to 'actionpack')

diff --git a/actionpack/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb b/actionpack/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb
index 2eb3eb31af..343153c8c5 100644
--- a/actionpack/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb
+++ b/actionpack/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb
@@ -17,7 +17,7 @@ module ActionView
 
         def asset_tag(source, options)
           # We force the :request protocol here to avoid a double-download bug in IE7 and IE8
-          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => ERB::Util.html_escape(path_to_asset(source, :protocol => :request)) }.merge(options), false, false)
+          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => path_to_asset(source, :protocol => :request) }.merge(options))
         end
 
         def custom_dir
diff --git a/actionpack/test/template/asset_tag_helper_test.rb b/actionpack/test/template/asset_tag_helper_test.rb
index d93433deac..aa7304b3ed 100644
--- a/actionpack/test/template/asset_tag_helper_test.rb
+++ b/actionpack/test/template/asset_tag_helper_test.rb
@@ -366,6 +366,10 @@ class AssetTagHelperTest < ActionView::TestCase
     assert stylesheet_link_tag('dir/other/file', 'dir/file2').html_safe?
   end
 
+  def test_stylesheet_link_tag_escapes_options
+    assert_dom_equal %(<link href="/file.css" media="&lt;script&gt;" rel="stylesheet" type="text/css" />), stylesheet_link_tag('/file', :media => '<script>')
+  end
+
   def test_custom_stylesheet_expansions
     ENV["RAILS_ASSET_ID"] = ''
     ActionView::Helpers::AssetTagHelper::register_stylesheet_expansion :robbery => ["bank", "robber"]
-- 
cgit v1.2.3