kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

text_helper now escape the unsafe input instead of sanitizing

Browse source 
Signed-off-by: José Valim <jose.valim@gmail.com>
This commit is contained in:
Santiago Pastorino 2010-06-11 04:37:10 -03:00 committed by José Valim
parent 51ad68367a
commit b4976ce91b
2 changed files with 12 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
actionpack/lib/action_view/helpers/text_helper.rb
View file

@ -74,7 +74,7 @@ module ActionView
options.reverse_merge!(:length => 30) options.reverse_merge!(:length => 30)
text = sanitize(text) unless text.html_safe? || options[:safe] text = h(text) unless text.html_safe? || options[:safe]
text.truncate(options.delete(:length), options) if text text.truncate(options.delete(:length), options) if text
end end
@ -106,7 +106,7 @@ module ActionView
end end
options.reverse_merge!(:highlighter => '<strong class="highlight">\1</strong>') options.reverse_merge!(:highlighter => '<strong class="highlight">\1</strong>')
text = sanitize(text) unless text.html_safe? || options[:safe] text = h(text) unless text.html_safe? || options[:safe]
if text.blank? || phrases.blank? if text.blank? || phrases.blank?
text text
else else
@ -244,7 +244,7 @@ module ActionView
def simple_format(text, html_options={}, options={}) def simple_format(text, html_options={}, options={})
text = '' if text.nil? text = '' if text.nil?
start_tag = tag('p', html_options, true) start_tag = tag('p', html_options, true)
text = sanitize(text) unless text.html_safe? || options[:safe] text = h(text) unless text.html_safe? || options[:safe]
text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n
text.gsub!(/\n\n+/, "</p>\n\n#{start_tag}") # 2+ newline -> paragraph text.gsub!(/\n\n+/, "</p>\n\n#{start_tag}") # 2+ newline -> paragraph
text.gsub!(/([^\n]\n)(?=[^\n])/, '\1<br />') # 1 newline -> br text.gsub!(/([^\n]\n)(?=[^\n])/, '\1<br />') # 1 newline -> br
@ -503,7 +503,7 @@ module ActionView
text.html_safe text.html_safe
else else
display_text = (block_given?) ? yield(text) : text display_text = (block_given?) ? yield(text) : text
display_text = sanitize(display_text) unless options[:safe] display_text = h(display_text) unless options[:safe]
mail_to text, display_text, html_options mail_to text, display_text, html_options
end end
end end

17
actionpack/test/template/text_helper_test.rb
View file

@ -41,7 +41,7 @@ class TextHelperTest < ActionView::TestCase
end end
def test_simple_format_should_sanitize_unsafe_input def test_simple_format_should_sanitize_unsafe_input
assert_equal "<p><b> test with unsafe string </b></p>", simple_format("<b> test with unsafe string </b><script>code!</script>") assert_equal "<p>&lt;b&gt; test with unsafe string &lt;/b&gt;&lt;script&gt;code!&lt;/script&gt;</p>", simple_format("<b> test with unsafe string </b><script>code!</script>")
end end
def test_simple_format_should_not_sanitize_input_if_safe_option def test_simple_format_should_not_sanitize_input_if_safe_option
@ -62,8 +62,7 @@ class TextHelperTest < ActionView::TestCase
end end
def test_truncate_should_sanitize_unsafe_input def test_truncate_should_sanitize_unsafe_input
assert_equal "Hello World!", truncate("Hello <script>code!</script>World!", :length => 12) assert_equal "Hello &lt...", truncate("Hello <script>code!</script>World!!", :length => 12)
assert_equal "Hello Wor...", truncate("Hello <script>code!</script>World!!", :length => 12)
end end
def test_truncate_should_not_sanitize_input_if_safe_option def test_truncate_should_not_sanitize_input_if_safe_option
@ -141,7 +140,7 @@ class TextHelperTest < ActionView::TestCase
def test_highlight_should_sanitize_unsafe_input def test_highlight_should_sanitize_unsafe_input
assert_equal( assert_equal(
"This is a <strong class=\"highlight\">beautiful</strong> morning", "This is a <strong class=\"highlight\">beautiful</strong> morning&lt;script&gt;code!&lt;/script&gt;",
highlight("This is a beautiful morning<script>code!</script>", "beautiful") highlight("This is a beautiful morning<script>code!</script>", "beautiful")
) )
end end
@ -190,23 +189,23 @@ class TextHelperTest < ActionView::TestCase
def test_highlight_with_html def test_highlight_with_html
assert_equal( assert_equal(
"<p>This is a <strong class=\"highlight\">beautiful</strong> morning, but also a <strong class=\"highlight\">beautiful</strong> day</p>", "&lt;p&gt;This is a <strong class=\"highlight\">beautiful</strong> morning, but also a <strong class=\"highlight\">beautiful</strong> day&lt;/p&gt;",
highlight("<p>This is a beautiful morning, but also a beautiful day</p>", "beautiful") highlight("<p>This is a beautiful morning, but also a beautiful day</p>", "beautiful")
) )
assert_equal( assert_equal(
"<p>This is a <em><strong class=\"highlight\">beautiful</strong></em> morning, but also a <strong class=\"highlight\">beautiful</strong> day</p>", "&lt;p&gt;This is a &lt;em&gt;<strong class=\"highlight\">beautiful</strong>&lt;/em&gt; morning, but also a <strong class=\"highlight\">beautiful</strong> day&lt;/p&gt;",
highlight("<p>This is a <em>beautiful</em> morning, but also a beautiful day</p>", "beautiful") highlight("<p>This is a <em>beautiful</em> morning, but also a beautiful day</p>", "beautiful")
) )
assert_equal( assert_equal(
"<p>This is a <em class=\"error\"><strong class=\"highlight\">beautiful</strong></em> morning, but also a <strong class=\"highlight\">beautiful</strong> <span class=\"last\">day</span></p>", "&lt;p&gt;This is a &lt;em class=&quot;error&quot;&gt;<strong class=\"highlight\">beautiful</strong>&lt;/em&gt; morning, but also a <strong class=\"highlight\">beautiful</strong> &lt;span class=&quot;last&quot;&gt;day&lt;/span&gt;&lt;/p&gt;",
highlight("<p>This is a <em class=\"error\">beautiful</em> morning, but also a beautiful <span class=\"last\">day</span></p>", "beautiful") highlight("<p>This is a <em class=\"error\">beautiful</em> morning, but also a beautiful <span class=\"last\">day</span></p>", "beautiful")
) )
assert_equal( assert_equal(
"<p class=\"beautiful\">This is a <strong class=\"highlight\">beautiful</strong> morning, but also a <strong class=\"highlight\">beautiful</strong> day</p>", "&lt;p class=&quot;<strong class=\"highlight\">beautiful</strong>&quot;&gt;This is a <strong class=\"highlight\">beautiful</strong> morning, but also a <strong class=\"highlight\">beautiful</strong> day&lt;/p&gt;",
highlight("<p class=\"beautiful\">This is a beautiful morning, but also a beautiful day</p>", "beautiful") highlight("<p class=\"beautiful\">This is a beautiful morning, but also a beautiful day</p>", "beautiful")
) )
assert_equal( assert_equal(
"<p>This is a <strong class=\"highlight\">beautiful</strong> <a href=\"http://example.com/beautiful\#top?what=beautiful%20morning&amp;when=now+then\">morning</a>, but also a <strong class=\"highlight\">beautiful</strong> day</p>", "&lt;p&gt;This is a <strong class=\"highlight\">beautiful</strong> &lt;a href=&quot;http://example.com/<strong class=\"highlight\">beautiful</strong>#top?what=<strong class=\"highlight\">beautiful</strong>%20morning&amp;when=now+then&quot;&gt;morning&lt;/a&gt;, but also a <strong class=\"highlight\">beautiful</strong> day&lt;/p&gt;",
highlight("<p>This is a beautiful <a href=\"http://example.com/beautiful\#top?what=beautiful%20morning&when=now+then\">morning</a>, but also a beautiful day</p>", "beautiful") highlight("<p>This is a beautiful <a href=\"http://example.com/beautiful\#top?what=beautiful%20morning&when=now+then\">morning</a>, but also a beautiful day</p>", "beautiful")
) )
end end