kotovalexarian-likes-github
/
haml--haml
mirror of https://github.com/haml/haml.git
1
0
Fork 0
Code Releases Activity

[Haml] Fix the nasty potential XSS issue that Rails fixed a bit ago.

This commit is contained in:
Nathan Weizenbaum 2009-10-11 15:43:13 -07:00
parent 25e06a126d
commit fcf0d8ff74
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc-src/HAML_CHANGELOG.md
View File

@ -3,6 +3,11 @@
* Table of contents
{:toc}
## 2.2.8 (Unreleased)
* Fixed a potential XSS issue with HTML escaping and wacky Unicode nonsense.
This is the same as [the issue fixed in Rails](http://groups.google.com/group/rubyonrails-security/browse_thread/thread/48ab3f4a2c16190f) a bit ago.
## [2.2.7](http://github.com/nex3/haml/commit/2.2.7)
* Fixed an `html2haml` issue where ERB attribute values

4
lib/haml/helpers.rb
View File

@ -473,7 +473,7 @@ END
# @param text [String] The string to sanitize
# @return [String] The sanitized string
def html_escape(text)
text.to_s.gsub(/[\"><&]/) { |s| HTML_ESCAPE[s] }
text.to_s.gsub(/[\"><&]/n) {|s| HTML_ESCAPE[s]}
end
# Escapes HTML entities in `text`, but without escaping an ampersand
@ -482,7 +482,7 @@ END
# @param text [String] The string to sanitize
# @return [String] The sanitized string
def escape_once(text)
text.to_s.gsub(/[\"><]|&(?!([a-zA-Z]+|(#\d+));)/) { |s| HTML_ESCAPE[s] }
text.to_s.gsub(/[\"><]|&(?!(?:[a-zA-Z]+|(#\d+));)/n) {|s| HTML_ESCAPE[s]}
end
# Returns whether or not the current template is a Haml template.