kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Added not to sanitize helper docs that it doesn't guarantee well-formed markup.

Browse source 
Signed-off-by: Michael Koziarski <michael@koziarski.com>

[#166 state:resolved]
This commit is contained in:
Michael Schuerig 2008-05-12 00:12:22 +02:00 committed by Michael Koziarski
parent 236f0bb67a
commit 9a137506a1
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
actionpack/lib/action_view/helpers/sanitize_helper.rb
View file

@ -48,6 +48,11 @@ module ActionView
# config.action_view.sanitized_allowed_attributes = 'id', 'class', 'style'
# end
#
# Please note that sanitizing user-provided text does not guarantee that the
# resulting markup is valid (conforming to a document type) or even well-formed.
# The output may still contain e.g. unescaped '<', '>', '&' characters and
# confuse browsers.
#
def sanitize(html, options = {})
self.class.white_list_sanitizer.sanitize(html, options)
end