Mislav's example was "" without .html_safe.
There's really no obvious way to make "" become html_safe without modifying
Ruby. What about:
x = ""
y = "#{x}#{safe_string}"
And even in the case of:
x = ""
x << safe_string
We'd have to override every single << in the system (a serious performance
problem) to achieve this.
In the end, the rule is simple and consistent. Direct instances of String
are always not html_safe. This means that concatenating safe Strings onto a
String results in an unsafe String.
Yehuda Katz
Architect | Engine Yard
(ph) 718.877.1325
On Tue, May 18, 2010 at 2:03 AM, Mislav Marohnić
<[email protected]>wrote:
> On Mon, May 17, 2010 at 23:54, David Genord II <[email protected]> wrote:
>
>> From your example
>> query = "".html_safe
>> query << params[:query] # This WOULD be escaped. The << operator is
>> overwritten to recognize whether what is being appended is html_safe and
>> escape it if it isn't to maintain an html_safe string
>>
>
> Ah, then my example was totally mistaken. Thank you. However, I still stand
> behind consistency, and not special-casing a practice that I don't find
> optimal for widespread use.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Ruby on Rails: Core" group.
> To post to this group, send email to [email protected].
> To unsubscribe from this group, send email to
> [email protected]<rubyonrails-core%[email protected]>
> .
> For more options, visit this group at
> http://groups.google.com/group/rubyonrails-core?hl=en.
>
--
You received this message because you are subscribed to the Google Groups "Ruby
on Rails: Core" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/rubyonrails-core?hl=en.
