@@ -41,7 +41,7 @@ module ActiveRecord #:nodoc:
val = send("#{column.name}_without_html_escaping")
#if htmlescaping is disabled, just send it as is.
- return val if @html_escaping_disabled
+ return val if CrossSiteSniper.disabled?
# Only escape strings. Other data types, such
# as 'nil', should be returned uncorrupted.
@@ -64,9 +64,9 @@ module ActiveRecord #:nodoc:
#catch without_html_escaping for non-column methods and simulate it
if method_sym.to_s[/(.+)_without_html_escaping/]
original_method = $1
- @html_escaping_disabled = true
+ CrossSiteSniper.disabled = true
val = self.send(original_method)
- @html_escaping_disabled = false
+ CrossSiteSniper.disabled = false
return val
else
super
@@ -123,3 +123,13 @@ module ActiveRecord #:nodoc:
end
end
end
+
+class CrossSiteSniper
+ def self.disabled?
+ @disabled
+ end
+
+ def self.disabled=(x)
+ @disabled = x
+ end
+end
\ No newline at end of file
lib/cross_site_sniper.rb
@@ -1,6 +1,6 @@
require 'test/unit'
require 'rubygems'
-gem 'activerecord', '>= 2.0.2'
+gem 'activerecord', '>= 2.3.0'
require 'active_record'
require 'erb'
require "#{File.dirname(__FILE__)}/../init"
@@ -12,7 +12,7 @@ class CrossSiteSniperTest < Test::Unit::TestCase
def setup
setup_db
@hunter = SnipeHunter.create(:name => '<b>One</b>', :title => '<b>One Title</b>', :description => '<b>One Description</b>',:age => 42)
- @snipe = Snipe.create(:species => '<b>Fitch</b>', :genus => '<b>Abercrombie</b>')
+ @snipe = Snipe.create(:species => '<b>Fitch</b>', :genus => '<b>Abercrombie</b>', :snipe_hunter => @hunter)
@leprechaun = Leprechaun.create(:name => '<b>Clover McGillicuty</b>')
end
@@ -47,12 +47,15 @@ class CrossSiteSniperTest < Test::Unit::TestCase
assert_equal('<b>Fitch</b>',snipe.species)
assert_equal('<b>Abercrombie</b>',snipe.genus)
+ assert_equal('<b>Fitch</b>',hunter.first_snipe_species)
+ assert_equal('<b>Fitch</b>',hunter.first_snipe_species_without_html_escaping)
+
assert_equal('<b>Clover McGillicuty</b>',leprechaun.name)
end
end
class SnipeHunter < ActiveRecord::Base
-
+ has_many :snipes
#make title unescaped
html_escape :except => :title
@@ -60,9 +63,12 @@ class SnipeHunter < ActiveRecord::Base
def description; '<b>Overriden</b>'; end
def name_and_age; "#{name}(#{age})"; end
+
+ def first_snipe_species; snipes.first.species; end
end
class Snipe < ActiveRecord::Base
+ belongs_to :snipe_hunter
#only escape species
html_escape :only => :species
end
@@ -87,6 +93,7 @@ def setup_db
end
create_table :snipes do |t|
+ t.column :snipe_hunter_id, :integer
t.column :species, :string
t.column :genus, :string
end
test/cross_site_sniper_test.rb
ff56d5b1646907f853553fe1c2d28ef4bb66414c
Jonathan Garvin
jon@5valleys.com
http://github.com/wwidea/cross_site_sniper/commit/0791bd6cc2eb0ebe5a4077b0dac503f23c2a1a31
0791bd6cc2eb0ebe5a4077b0dac503f23c2a1a31
2009-02-17T21:05:45-08:00
2009-02-17T21:05:45-08:00
Fix turning off escaping on methods that call other text fields in other classes.
d512801f083a508d241addb0483f3c06f82c8e2c
Jonathan Garvin
jon@5valleys.com