On Mon, May 31, 2010 at 5:08 PM, Ryan Bigg <[email protected]> wrote:
> This was a bug in 2.3.7 and is not supposed to be the case in 2.3.8. Please
> ensure your application really is using 2.3.8.
I'm still seeing problems with the 2.3.8 gems, in particular if the
output from a Rails helper is concatenated with a fixed string:
def test1
"test1<br>test1<br>"
end
def test2
link_to_function("test2", "alert('test2')") + "<br>test2<br>"
end
Then if a view has:
<%= test1 %>
<%= test2 %>
With 2.3.5 and earlier the HTML output is correct:
test1<br>test1<br>
<a href="#" onclick="alert('test2'); return false;">test2</a><br>test2<br>
But with 2.3.8 the literal string appended to the helper results is
incorrectly escaped:
test1<br>test1<br>
<a href="#" onclick="alert('test2'); return
false;">test2</a><br>test2<br>
Of course this is what we expect if using Rails 3 or the rails_xss
plugin, but it is not expected from the 2.3.8 upgrade (with rails_xss
not installed).
I've confirmed I have 2.3.8 installed - frozen in, and the top entry
in the actionpack changelog is "* HTML safety: fix compatibility
*without* the optional rails_xss plugin."
--
You received this message because you are subscribed to the Google Groups "Ruby
on Rails: Core" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/rubyonrails-core?hl=en.
