From 37695b8aabc1386f21039b16c32541d71f0d4182 Mon Sep 17 00:00:00 2001 From: Kasper Timm Hansen Date: Sat, 7 Mar 2015 18:48:06 +0100 Subject: Let strip_tags leave HTML escaping to Rails. Prevents double escaping errors, such as "&" becoming "&". --- actionview/actionview.gemspec | 2 +- actionview/lib/action_view/helpers/sanitize_helper.rb | 2 +- actionview/test/template/sanitize_helper_test.rb | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) (limited to 'actionview') diff --git a/actionview/actionview.gemspec b/actionview/actionview.gemspec index 8f9194cda7..8c4e633db7 100644 --- a/actionview/actionview.gemspec +++ b/actionview/actionview.gemspec @@ -23,7 +23,7 @@ Gem::Specification.new do |s| s.add_dependency 'builder', '~> 3.1' s.add_dependency 'erubis', '~> 2.7.0' - s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.1' + s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.2' s.add_dependency 'rails-dom-testing', '~> 1.0', '>= 1.0.5' s.add_development_dependency 'actionpack', version diff --git a/actionview/lib/action_view/helpers/sanitize_helper.rb b/actionview/lib/action_view/helpers/sanitize_helper.rb index 463a4e9f60..a2e9f37453 100644 --- a/actionview/lib/action_view/helpers/sanitize_helper.rb +++ b/actionview/lib/action_view/helpers/sanitize_helper.rb @@ -99,7 +99,7 @@ module ActionView # strip_tags("
Welcome to my website!
") # # => Welcome to my website! def strip_tags(html) - self.class.full_sanitizer.sanitize(html) + self.class.full_sanitizer.sanitize(html, encode_special_chars: false) end # Strips all link tags from +html+ leaving just the link text. diff --git a/actionview/test/template/sanitize_helper_test.rb b/actionview/test/template/sanitize_helper_test.rb index e4be21be2c..efe846a7eb 100644 --- a/actionview/test/template/sanitize_helper_test.rb +++ b/actionview/test/template/sanitize_helper_test.rb @@ -29,6 +29,10 @@ class SanitizeHelperTest < ActionView::TestCase assert_equal "", strip_tags("").html_safe? end -- cgit v1.2.3