0
@@ -1,5 +1,7 @@
0
 *SVN*
0
 
0
+* add json_escape ERB util to escape html entities in json strings that are output in HTML pages. [rick]
0
+
0
 * Provide a helper proxy to access helper methods from outside views. Closes #10839 [Josh Peek]
0
   e.g. ApplicationController.helpers.simple_format(text)
0
 

0
@@ -2,7 +2,8 @@ require 'erb'
0
 
0
 class ERB
0
   module Util
0
-    HTML_ESCAPE = { '&' => '&amp;', '"' => '&quot;', '>' => '&gt;', '<' => '&lt;' }
0
+    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;' }
0
+    JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C'}
0
 
0
     # A utility method for escaping HTML tag characters.
0
     # This method is also aliased as <tt>h</tt>.
0
@@ -16,6 +17,23 @@ class ERB
0
     def html_escape(s)
0
       s.to_s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }
0
     end
0
+
0
+    # A utility method for escaping HTML entities in JSON strings.
0
+    # This method is also aliased as <tt>j</tt>.
0
+    #
0
+    # In your ERb templates, use this method to escape any HTML entities:
0
+    #   <%=j @person.to_json %>
0
+    #
0
+    # ==== Example:
0
+    #   puts json_escape("is a > 0 & a < 10?")
0
+    #   # => is a \u003E 0 \u0026 a \u003C 10?
0
+    def json_escape(s)
0
+      s.to_s.gsub(/[&"><]/) { |special| JSON_ESCAPE[special] }
0
+    end
0
+
0
+    alias j json_escape
0
+    module_function :j
0
+    module_function :json_escape
0
   end
0
 end
0
 

0
@@ -2,21 +2,17 @@ require 'abstract_unit'
0
 
0
 class ErbUtilTest < Test::Unit::TestCase
0
   include ERB::Util
0
-  
0
-  def test_amp
0
-    assert_equal '&amp;', html_escape('&')
0
-  end
0
-  
0
-  def test_quot
0
-    assert_equal '&quot;', html_escape('"')
0
-  end
0
 
0
-  def test_lt
0
-    assert_equal '&lt;', html_escape('<')
0
-  end
0
+  ERB::Util::HTML_ESCAPE.each do |given, expected|
0
+    define_method "test_html_escape_#{expected.gsub /\W/, ''}" do
0
+      assert_equal expected, html_escape(given)
0
+    end
0
 
0
-  def test_gt
0
-    assert_equal '&gt;', html_escape('>')
0
+    unless given == '"'
0
+      define_method "test_json_escape_#{expected.gsub /\W/, ''}" do
0
+        assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
0
+      end
0
+    end
0
   end
0
   
0
   def test_rest_in_ascii