f27e7ebc0e2a55a268631c78d49a5b70b06ad59a Michael Koziarski michael@koziarski.com http://github.com/rails/rails/commit/9415935902f120a9bac0bfce7129725a0db38ed3 9415935902f120a9bac0bfce7129725a0db38ed3

2009-10-07T13:31:20-07:00

Switch to on-by-default XSS escaping for rails. This consists of: * String#html_safe! a method to mark a string as 'safe' * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it * Calls to String#html_safe! throughout the rails helpers * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB) * New ERB implementation based on erubis which uses a SafeBuffer instead of a String Hat tip to Django for the inspiration. 654d184caccfd7e1de4d60236fb7813bf1177d84 Michael Koziarski michael@koziarski.com 9a73630d935e360f3dc896e50dd673afb97cf3b5 Michael Koziarski michael@koziarski.com http://github.com/rails/rails/commit/b16e0c922344da256ab977fd5e7a7f69e0be90fc b16e0c922344da256ab977fd5e7a7f69e0be90fc

2009-09-03T14:25:38-07:00

2009-08-31T12:07:30-07:00

Clean tag attributes before passing through the escape_once logic. Addresses CVE-2009-3009 6d92ec5c5a719dfe9a0803158d60fd1d97528c0d Michael Koziarski michael@koziarski.com 761283ffdb5750f8a38e2ed67891d2b2b9152d7f rizwanreza rizwanreza@gmail.com http://github.com/rails/rails/commit/5786395760f1e1906c878df4023cac3741e66e87 5786395760f1e1906c878df4023cac3741e66e87

2009-08-08T14:21:32-07:00

2009-08-08T14:21:25-07:00

Allow content_tag options to take an array [#1741 state:resolved] [rizwanreza, Nick Quaranto] Example: content_tag('p', "limelight", :class => ["song", "play"]) # => <p class="song play">limelight</p> Signed-off-by: Pratik Naik <pratiknaik@gmail.com> a85a8c2dd8c5a3803103c52d1b04d7f0e6801025 Pratik Naik pratiknaik@gmail.com d83b1828577c268de56e1b3942e16002c9efdd57 Marc Love marcslove@gmail.com http://github.com/rails/rails/commit/d860c8917023e62d24c239bbc9aa6c629704f416 d860c8917023e62d24c239bbc9aa6c629704f416

2009-07-30T09:48:27-07:00

2009-07-30T03:57:07-07:00

Fix tag helpers so that all HTML element boolean attributes render according to the specs. Added all boolean attributes listed in the XHTML 1.0 specs (http://www.w3.org/TR/xhtml1/guidelines.html) and HTML 5 specs (http://www.whatwg.org/specs/web-apps/current-work). HTML 5 boolean attribute rendering was broken in commit 1e2d7229602f467cfdc0ef606b5ef8a5566a1501 / [#2864 state:resolved]. Signed-off-by: Yehuda Katz <wycats@gmail.com> c4ad597de1a6790fc0b3d0d8a57778de90571d75 Yehuda Katz wycats@gmail.com 61604feec0fa04810f5903d13b74bad06e67b3bb Emilio Tagua miloops@gmail.com http://github.com/rails/rails/commit/1e2d7229602f467cfdc0ef606b5ef8a5566a1501 1e2d7229602f467cfdc0ef606b5ef8a5566a1501

2009-07-07T15:56:27-07:00

2009-07-03T05:29:30-07:00

Adds a audio_tag helper for the HTML5 audio tag. Fixed video_path docs. HTML attributes values should be true or false not attribute's name. [#2864 state:resolved] Signed-off-by: Yehuda Katz <wycats@yehuda-katzs-macbookpro41.local> 4ee6cbf96919ae754c09f22931e1837472622f6c Yehuda Katz wycats@yehuda-katzs-macbookpro41.local 9eab435631e1b0a659126d068972ee88cff160de Tieg Zaharia tieg.zaharia@gmail.com http://github.com/rails/rails/commit/51d7b3070c68492f5376c19d24d8e5a2d746d7ea 51d7b3070c68492f5376c19d24d8e5a2d746d7ea

2009-07-02T10:36:38-07:00

2009-06-26T11:38:18-07:00

Adds a video_tag helper for the HTML5 video tag (similar to how the image_tag works) (tests included); removes a duplicate test line for image_tag; adds boolean attributes for video tag to tag()'s boolean attributes Signed-off-by: Yehuda Katz + Carl Lerche <ykatz+clerche@engineyard.com> a3302e0f244589e854dcdcd3919bf1454058fbab Yehuda Katz + Carl Lerche ykatz+clerche@engineyard.com 49a84ff69ca4fc4db821ca3b5a5926d07832c845 Yehuda Katz + Carl Lerche ykatz+clerche@engineyard.com http://github.com/rails/rails/commit/8fac2c88cae0f2fd42fad3c2c2c6c860df14d629 8fac2c88cae0f2fd42fad3c2c2c6c860df14d629

2009-05-14T15:30:35-07:00

Cleaning up more render tests d959ad5fa6cf72cc8c887cdf1ebdfe2ddea94bc4 Yehuda Katz + Carl Lerche ykatz+clerche@engineyard.com bf2532616e3ac9a66b0041565e487329e3ad2489 Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/014b7994ac1a829845e2882f4c852bc28bd2aa53 014b7994ac1a829845e2882f4c852bc28bd2aa53

2008-12-09T12:13:33-08:00

2008-12-09T12:12:25-08:00

Explicitly require ERB Utils extensions from TagHelper 138efce362ad077d6b6fcd446fec25368905ba59 Joshua Peek josh@joshpeek.com 9eca588bdfbb41f6b48477025d1cd8eea4a38296 Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/commit/dbbae5e00e49d3a69dc10978e38299e3f28dd1e1 dbbae5e00e49d3a69dc10978e38299e3f28dd1e1

2008-12-06T18:27:53-08:00

Merge with docrails 592710207a614428d5cb809f6e13c8b546b58969 Pratik Naik pratiknaik@gmail.com f54ae9a9976ec6b4ec228a535edd9b32cc60c43d Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/3db59ce0dc91b73e106957dcf252bbae31679dfc 3db59ce0dc91b73e106957dcf252bbae31679dfc

2008-12-03T08:23:43-08:00

Unnecessary CGI require e0c09d57cfb69960f750907ae0d30e323cbafd94 Jeremy Kemper jeremy@bitsweat.net 19e9a1f47db89fc94b1c1f0e8bd533c9e925f4d1 Hongli Lai (Phusion) hongli@phusion.nl http://github.com/rails/rails/commit/337c361e26fe5647036f94556fe792535a921f93 337c361e26fe5647036f94556fe792535a921f93

2008-11-18T11:50:31-08:00

2008-11-18T11:45:55-08:00

Register 'checked' as an HTML boolean attribute. This way, 'tag :foo, :type => "checkbox", :checked => false' would output the expected <input type="checkbox" /> instead of the old <input type="checkbox" checked="false" /> The latter would result in a checkbox that's initially checked. Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> b584abbf5c02f7ad0b9f138ed75771c98721129b Jeremy Kemper jeremy@bitsweat.net 4c0921024471c0463d67f8b8fb6a115a94d343aa Hongli Lai (Phusion) hongli@phusion.nl http://github.com/rails/rails/commit/4e9abdd7f1b4e05f8d1b50ddaa080b3ff63b92d9 4e9abdd7f1b4e05f8d1b50ddaa080b3ff63b92d9

2008-11-13T12:55:58-08:00

2008-11-13T12:49:23-08:00

Tag helper should output an attribute with the value 'false' instead of omitting the attribute, if the associated option is false but not nil. da8f41b6b511a4fdf04d1d25ee0e94ec7cd19475 Michael Koziarski michael@koziarski.com f7d08acd5e0650658383e3d3f86d6ff5b49e9030 Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/commit/0432d151647f2178ddee79979827d552447c251f 0432d151647f2178ddee79979827d552447c251f

2008-07-16T05:01:23-07:00

2008-07-16T05:00:36-07:00

Merge with docrails. 7c772cd260eb051cd7b80cf91468555f03db9e11 Pratik Naik pratiknaik@gmail.com 4d76bad387036d96a955eae7c260a9633e915d11 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/3c282f3a0a7c1d5ab91241674251794ead5fa41d 3c282f3a0a7c1d5ab91241674251794ead5fa41d

2008-07-15T10:42:50-07:00

Ruby 1.9 compat: only eval with block.binding in 1.9, uses more memory than eval with block b778441511f7aae27fd56d6a36facea30ee7e0a2 Jeremy Kemper jeremy@bitsweat.net fc89a951933638b051bb1f9e1339ee6ae7c94cda 松田明 matsuda@tatsujin.tafc.co.jp http://github.com/rails/rails/commit/bb33432b0f5bf644713e696e4dafc7e7d3cc5808 bb33432b0f5bf644713e696e4dafc7e7d3cc5808

2008-07-15T10:39:02-07:00

2008-07-15T05:30:20-07:00

Ruby 1.9 compat: call Proc#binding explicitly. [#623 state:resolved] bb07d0fe698f1ed812bd9fd1408b783ee6259178 Jeremy Kemper jeremy@bitsweat.net 9a0e4437199a233105348938e490808fc0688626 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/f4ccc179530d5b9436da87d3c221dfa8fa89119a f4ccc179530d5b9436da87d3c221dfa8fa89119a

2008-06-21T14:54:10-07:00

Performance: javascript helper tweaks to speed up escaping and reduce object allocations when building options strings 6ace7c7bd35cef137e84057a566cdb97dbf5b53b Jeremy Kemper jeremy@bitsweat.net c440c9b199d7474e356472616ef03f9c7e17c405 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/72f93b581f1d1a7496ccebbd90578714c171c5a5 72f93b581f1d1a7496ccebbd90578714c171c5a5

2008-06-19T22:21:56-07:00

2008-06-19T22:03:27-07:00

Check whether blocks are called from erb using a special __in_erb_template variable visible in block binding. 0e89550d0297bba6a87c8eae507c7388d62c92e8 Jeremy Kemper jeremy@bitsweat.net d9fb021845c0481c5119eebdc534aec427072f7d Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/ff5f155f8dc1d2ba363718c3e17f99719399eab5 ff5f155f8dc1d2ba363718c3e17f99719399eab5

2008-06-08T20:05:39-07:00

Use output_buffer reader and writer methods exclusively instead of hitting the instance variable so others can override the methods. 6d6e353284cc9c630697ae92f710df499d2f8197 Jeremy Kemper jeremy@bitsweat.net 49c4c7b997c9e55907c78723c73f537087b1497d e2c49e6a59f1b969a526586a3dd4dfd9c6f12b10 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/fec0f0678bef93f98cf1204bb007d109bbe97c37 fec0f0678bef93f98cf1204bb007d109bbe97c37

2008-06-06T04:13:23-07:00

Merge branch 'master' into erbout 08fb8a5fa8070c1ceac5f40974eb659a21e0a274 Jeremy Kemper jeremy@bitsweat.net fd40fbc1983a96587cc25729985191573a03e04c Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/e2c49e6a59f1b969a526586a3dd4dfd9c6f12b10 e2c49e6a59f1b969a526586a3dd4dfd9c6f12b10

2008-06-06T04:13:09-07:00

Drop a string conversion from the often-called tag_options helper 9354aa962ad01710c87891ef8bb7d2dd7ca45526 Jeremy Kemper jeremy@bitsweat.net 0bdb7d353b4ac6f5470884360f9a480a16bd709c Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/4d4c8e298f5396e6b8ace0a10d7f991594aace2d 4d4c8e298f5396e6b8ace0a10d7f991594aace2d

2008-06-02T21:32:50-07:00

2008-06-02T13:49:14-07:00

Don't pass block binding to concat 2a5d4704d307ff2469de6226c9c2fbb691e75e32 Jeremy Kemper jeremy@bitsweat.net da91450e687fe9faa7b0575062c2b2aacc261f68 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/933697a5fc5f4c56c4fd7fbbd31b8973df9c1054 933697a5fc5f4c56c4fd7fbbd31b8973df9c1054

2008-06-02T21:32:50-07:00

2008-06-02T09:12:00-07:00

Try replacing _erbout with @output_buffer 44f55a5c801e94db8c3637c73dfc6db7f2c3350d Jeremy Kemper jeremy@bitsweat.net 38454983b48a117737bcd25d3962e2578d6c38f0 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/4b33306c704d6429e42e317802c92bc57f0de61c 4b33306c704d6429e42e317802c92bc57f0de61c

2007-09-24T01:13:55-07:00

The tag helper may bypass escaping. git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7608 5ecf4fe2-1ee6-0310-87b1-e25e094e27de d8486d2913a5433be9ab31c74fa8357f93a0e376 Jeremy Kemper jeremy@bitsweat.net cb5b8a7f055966c1f3e2d65d09c1b914e82d2c39 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/e711d8fade2a47e4a709fa3eb4b8dd7af6f6ac08 e711d8fade2a47e4a709fa3eb4b8dd7af6f6ac08

2007-09-23T22:43:59-07:00

escape_once uses negative lookahead to avoid double-escaping instead of a second gsub git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7606 5ecf4fe2-1ee6-0310-87b1-e25e094e27de e372b3807c822d37b2bd24495242bd16459379d6 Jeremy Kemper jeremy@bitsweat.net 7010ee361ec71ed1a37962897cebc8684d90aa35 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/8fd263cd4ec740bda56b6f4c0d3e2ddd91f05722 8fd263cd4ec740bda56b6f4c0d3e2ddd91f05722

2007-09-18T03:55:15-07:00

tag_options creates fewer objects git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7512 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 3bf61c55c6ef2fd2f91c9032c8a3f925280e93f9 Jeremy Kemper jeremy@bitsweat.net 8aefa3ee75e261488a39ea9d26a767c9db696c20 David Heinemeier Hansson david@loudthinking.com http://github.com/rails/rails/commit/b00e6a984df51a2f891c2a4c819ac2ab08359eed b00e6a984df51a2f891c2a4c819ac2ab08359eed

2007-06-23T10:49:18-07:00

Massive documentation update for all helpers (closes #8223, #8177, #8175, #8108, #7977, #7972, #7971, #7969) [jeremymcanally] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7106 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 963bdbbc51159f294be459788c2a57eef0624f1d David Heinemeier Hansson david@loudthinking.com 0778464168960a830b806f66a200e86a163a5831 David Heinemeier Hansson david@loudthinking.com http://github.com/rails/rails/commit/edaf6baea72c48dc90af3cb6b0a1078228f85f89 edaf6baea72c48dc90af3cb6b0a1078228f85f89

2007-05-02T15:30:41-07:00

Fixed that content_tag with a block will just return the result instead of concate it if not used in a ERb view #7857, #7432 [michael.niessner] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@6652 5ecf4fe2-1ee6-0310-87b1-e25e094e27de f732f5028453c1cab4800229feed26de9834bf6c David Heinemeier Hansson david@loudthinking.com 1400e7f864efa25ab8dc98930ace8a6e40414461 Rick Olson technoweenie@gmail.com http://github.com/rails/rails/commit/730c8e8391310330a175454cc73066979ee8b04c 730c8e8391310330a175454cc73066979ee8b04c

2007-01-05T12:32:03-08:00

Clean up multiple calls to #stringify_keys in TagHelper, add better documentation and testing for TagHelper. Closes #6394 [Bob Silva] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5857 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 45ab3219e26df44298b6ea1565ee3c807a27238f Rick Olson technoweenie@gmail.com e407b44ba14e5ab72f25ca107291e7a4d51051b8 Rick Olson technoweenie@gmail.com http://github.com/rails/rails/commit/f7c916ece661ac0d5936ca47f83ebfbf4852a8bb f7c916ece661ac0d5936ca47f83ebfbf4852a8bb

2006-10-23T20:06:57-07:00

Added block-usage to PrototypeHelper#form_remote_tag, document block-usage of FormTagHelper#form_tag [Rick] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5346 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 98616b4ae6871bc0a64d4a56bcc21c399884c321 Rick Olson technoweenie@gmail.com 9c9443812f1274667cea14edd387c6124205ac1c David Heinemeier Hansson david@loudthinking.com http://github.com/rails/rails/commit/6c062054cdb236fead5d09679985ebb70d8b053a 6c062054cdb236fead5d09679985ebb70d8b053a

2006-10-23T15:57:59-07:00

Added block-usage to TagHelper#content_tag [DHH] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5344 5ecf4fe2-1ee6-0310-87b1-e25e094e27de fc50fc2b66a928c89f1e009b060952d459546a58 David Heinemeier Hansson david@loudthinking.com 02358c83b76f9fc56b6cabaee24b244d17d08cff Rick Olson technoweenie@gmail.com http://github.com/rails/rails/commit/dbd0bd5e5c9946ffb48bf8651f81ebc6dd9b52e5 dbd0bd5e5c9946ffb48bf8651f81ebc6dd9b52e5

2006-10-18T09:42:19-07:00

Add <%= escape_once html %> to escape html while leaving any currently escaped entities alone. Fix button_to double-escaping issue. [Rick] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5322 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 0b285eb84a3a651e3b1ba59b64010644bc7fcc45 Rick Olson technoweenie@gmail.com a0f74092a8fa1eff96de67b70c711fd8408a4ab5 Rick Olson technoweenie@gmail.com http://github.com/rails/rails/commit/02358c83b76f9fc56b6cabaee24b244d17d08cff 02358c83b76f9fc56b6cabaee24b244d17d08cff

2006-10-18T08:58:07-07:00

Fix double-escaped entities, such as &amp;, &#123;, etc. [Rick] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@5321 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 88b5b9b207163e5d5ceb48e6e7c672c78dc65d91 Rick Olson technoweenie@gmail.com b840e4ed509da433895fd2becf13f3e5656708e4 Sam Stephenson sam@37signals.com http://github.com/rails/rails/commit/f49dc37e7100d8358d864a6e008c17acd24765fc f49dc37e7100d8358d864a6e008c17acd24765fc

2005-10-12T15:47:39-07:00

Wrap javascript_tag contents in a CDATA section and add a cdata_section method to TagHelper. Closes #1691. git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2543 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 10b737ba4c573cdec74362f427e605d72996f166 Sam Stephenson sam@37signals.com 0886bb391d97ec96d3028d5cac93ce2f7f8467e6 Marcel Molina marcel@vernix.org http://github.com/rails/rails/commit/064842f516513eab305cb8a3257e32164cda68cb 064842f516513eab305cb8a3257e32164cda68cb

2005-10-10T14:34:51-07:00

Convert boolean form options form the tag_helper. Recloses #809. git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2523 5ecf4fe2-1ee6-0310-87b1-e25e094e27de 58aeca26b9a9e4ff018f0b5996ab66b45666918e Marcel Molina marcel@vernix.org 47292cdef7fe9ca21c749c7fe594457ee1c81de6 David Heinemeier Hansson david@loudthinking.com http://github.com/rails/rails/commit/7f26415d3c0e4101ce1569a499470e8a32dbfede 7f26415d3c0e4101ce1569a499470e8a32dbfede

2005-09-20T00:54:55-07:00

Optimized tag_options to not sort keys, which is no longer necessary when assert_dom_equal and friend is available #1995 [skae]. Added assert_dom_equal and assert_dom_not_equal to compare tags generated by the helpers in an order-indifferent manner #1995 [skae] git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@2271 5ecf4fe2-1ee6-0310-87b1-e25e094e27de bd1b1db0161dea64945daca530acbf3d09e13cc9 David Heinemeier Hansson david@loudthinking.com