Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove uses of h escaping #39

Closed
gravitystorm opened this issue Dec 20, 2019 · 1 comment
Closed

Remove uses of h escaping #39

gravitystorm opened this issue Dec 20, 2019 · 1 comment

Comments

@gravitystorm
Copy link
Owner

h(@model.attribute) was a common way to avoid html injection in the rails 2.x era. Since rails 3, all text fetched from the database is escaped automatically, and so e.g. h(@user.display_name) is unnecessary.

The only edge cases are where we are directly messing around with the escaping system, by using things like raw (#38), html_safe and so on. But in the vast majority of cases, the h(...) is no longer necessary.

Removing this avoids new contributors having to figure out what's going on, as well as making the code more readable.
@gravitystorm
Copy link
Owner Author

openstreetmap#2562

gravitystorm pushed a commit that referenced this issue Oct 26, 2022
@openbrian
get_text("reversegeocode/result") returns an XML node. We want to get…
8eb2abc 
… the text value of that node.

This will unescape ' into an apostrophe.

All callers of this function will later re-encode it depending out output whether it be HTML in an email, or XML in an RSS feed.

* app/mailers/user_mail.rb
* app/helpers/geocode_helper.rb
* app/views/api/notes/feed.rss.builder
* app/views/api/notes/_note.rss.builder

Fixes openstreetmap#3761
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@gravitystorm