From bcab3f20dac0fe993e5d31bf6acef28ec54e658b Mon Sep 17 00:00:00 2001 From: Paul Grayson Date: Tue, 10 Jun 2014 17:33:34 -0700 Subject: In tag helper, honor html_safe on array parameters; also make safe_join more similar to Array.join by first calling flatten. --- .../test/template/output_safety_helper_test.rb | 9 +++++++- actionview/test/template/tag_helper_test.rb | 24 ++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) (limited to 'actionview/test/template') diff --git a/actionview/test/template/output_safety_helper_test.rb b/actionview/test/template/output_safety_helper_test.rb index 76c71c9e6d..a1bf0e1a5f 100644 --- a/actionview/test/template/output_safety_helper_test.rb +++ b/actionview/test/template/output_safety_helper_test.rb @@ -25,4 +25,11 @@ class OutputSafetyHelperTest < ActionView::TestCase assert_equal "

foo


bar

", joined end -end \ No newline at end of file + test "safe_join should work recursively similarly to Array.join" do + joined = safe_join(['a',['b','c']], ':') + assert_equal 'a:b:c', joined + + joined = safe_join(['"a"',['','']], '
') + assert_equal '"a" <br/> <b> <br/> <c>', joined + end +end diff --git a/actionview/test/template/tag_helper_test.rb b/actionview/test/template/tag_helper_test.rb index fb016a52de..c78b6450f2 100644 --- a/actionview/test/template/tag_helper_test.rb +++ b/actionview/test/template/tag_helper_test.rb @@ -80,11 +80,27 @@ class TagHelperTest < ActionView::TestCase str = content_tag('p', "limelight", :class => ["song", "play"]) assert_equal "

limelight

", str + + str = content_tag('p', "limelight", :class => ["song", ["play"]]) + assert_equal "

limelight

", str end def test_content_tag_with_unescaped_array_class str = content_tag('p', "limelight", {:class => ["song", "play>"]}, false) assert_equal "

\">limelight

", str + + str = content_tag('p', "limelight", {:class => ["song", ["play>"]]}, false) + assert_equal "

\">limelight

", str + end + + def test_content_tag_with_empty_array_class + str = content_tag('p', 'limelight', {:class => []}) + assert_equal '

limelight

', str + end + + def test_content_tag_with_unescaped_empty_array_class + str = content_tag('p', 'limelight', {:class => []}, false) + assert_equal '

limelight

', str end def test_content_tag_with_data_attributes @@ -115,6 +131,14 @@ class TagHelperTest < ActionView::TestCase end end + def test_tag_honors_html_safe_with_escaped_array_class + str = tag('p', :class => ['song>', 'play>'.html_safe]) + assert_equal '

', str + + str = tag('p', :class => ['song>'.html_safe, 'play>']) + assert_equal '

', str + end + def test_skip_invalid_escaped_attributes ['&1;', 'dfa3;', '& #123;'].each do |escaped| assert_equal %(), tag('a', :href => escaped) -- cgit v1.2.3