Skip to content
Permalink
Browse files

Always escape `'` in Haml::Helpers.#html_escape.

In some tests, `attr_wrapper` is changed to be ignored.

I'll split its fix to other commis because not Haml::Helpers but
Haml::AttributeBuilder is responsible for that.
  • Loading branch information
k0kubun committed Feb 8, 2017
1 parent a171248 commit 18576ae6e9bdcb4303fdbe6b3199869d289d67c2
@@ -596,7 +596,7 @@ def haml_tag_if(condition, *tag)
# Characters that need to be escaped to HTML entities from user input
HTML_ESCAPE = { '&' => '&amp;', '<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#039;' }

HTML_ESCAPE_REGEX = /[\"><&]/
HTML_ESCAPE_REGEX = /['"><&]/

# Returns a copy of `text` with ampersands, angle brackets and quotes
# escaped into HTML entities.
@@ -1127,8 +1127,8 @@ def test_doctypes
def test_attr_wrapper
assert_equal("<p strange=*attrs*></p>\n", render("%p{ :strange => 'attrs'}", :attr_wrapper => '*'))
assert_equal("<p escaped='quo\"te'></p>\n", render("%p{ :escaped => 'quo\"te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"quo'te\"></p>\n", render("%p{ :escaped => 'quo\\'te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"q'uo&#x0022;te\"></p>\n", render("%p{ :escaped => 'q\\'uo\"te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"quo&#039;te\"></p>\n", render("%p{ :escaped => 'quo\\'te'}", :attr_wrapper => '"'))
assert_equal("<p escaped='q&#039;uo\"te'></p>\n", render("%p{ :escaped => 'q\\'uo\"te'}", :attr_wrapper => '"'))
assert_equal("<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n", render("!!! XML", :attr_wrapper => '"', :format => :xhtml))
end

@@ -1534,7 +1534,7 @@ def test_html5_data_attributes_without_hyphenation
render("%div{:data => {:one_plus_one => 1+1}}",
:hyphenate_data_attrs => false))

assert_equal("<div data-foo='Here&#x0027;s a \"quoteful\" string.'></div>\n",
assert_equal("<div data-foo='Here&#039;s a \"quoteful\" string.'></div>\n",
render(%{%div{:data => {:foo => %{Here's a "quoteful" string.}}}},
:hyphenate_data_attrs => false)) #'
end
@@ -1698,9 +1698,9 @@ def test_truthy_new_attributes
def test_new_attribute_parsing
assert_equal("<a a2='b2'>bar</a>\n", render("%a(a2=b2) bar", :locals => {:b2 => 'b2'}))
assert_equal(%Q{<a a='foo"bar'>bar</a>\n}, render(%q{%a(a="#{'foo"bar'}") bar})) #'
assert_equal(%Q{<a a="foo'bar">bar</a>\n}, render(%q{%a(a="#{"foo'bar"}") bar})) #'
assert_equal(%Q{<a a='foo&#039;bar'>bar</a>\n}, render(%q{%a(a="#{"foo'bar"}") bar})) #'
assert_equal(%Q{<a a='foo"bar'>bar</a>\n}, render(%q{%a(a='foo"bar') bar}))
assert_equal(%Q{<a a="foo'bar">bar</a>\n}, render(%q{%a(a="foo'bar") bar}))
assert_equal(%Q{<a a='foo&#039;bar'>bar</a>\n}, render(%q{%a(a="foo'bar") bar}))
assert_equal("<a a:b='foo'>bar</a>\n", render("%a(a:b='foo') bar"))
assert_equal("<a a='foo' b='bar'>bar</a>\n", render("%a(a = 'foo' b = 'bar') bar"))
assert_equal("<a a='foo' b='bar'>bar</a>\n", render("%a(a = foo b = bar) bar", :locals => {:foo => 'foo', :bar => 'bar'}))
@@ -1713,8 +1713,8 @@ def test_new_attribute_escaping
assert_equal(%Q{<a a='foo " bar'>bar</a>\n}, render(%q{%a(a="foo \" bar") bar}))
assert_equal(%Q{<a a='foo \\" bar'>bar</a>\n}, render(%q{%a(a="foo \\\\\" bar") bar}))

assert_equal(%Q{<a a="foo ' bar">bar</a>\n}, render(%q{%a(a='foo \' bar') bar}))
assert_equal(%Q{<a a="foo \\' bar">bar</a>\n}, render(%q{%a(a='foo \\\\\' bar') bar}))
assert_equal(%Q{<a a='foo &#039; bar'>bar</a>\n}, render(%q{%a(a='foo \' bar') bar}))
assert_equal(%Q{<a a='foo \\&#039; bar'>bar</a>\n}, render(%q{%a(a='foo \\\\\' bar') bar}))

assert_equal(%Q{<a a='foo \\ bar'>bar</a>\n}, render(%q{%a(a="foo \\\\ bar") bar}))
assert_equal(%Q{<a a='foo \#{1 + 1} bar'>bar</a>\n}, render(%q{%a(a="foo \#{1 + 1} bar") bar}))
@@ -1129,8 +1129,8 @@ def test_doctypes
def test_attr_wrapper
assert_equal("<p strange=*attrs*></p>\n", render("%p{ :strange => 'attrs'}", :attr_wrapper => '*'))
assert_equal("<p escaped='quo\"te'></p>\n", render("%p{ :escaped => 'quo\"te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"quo'te\"></p>\n", render("%p{ :escaped => 'quo\\'te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"q'uo&#x0022;te\"></p>\n", render("%p{ :escaped => 'q\\'uo\"te'}", :attr_wrapper => '"'))
assert_equal("<p escaped=\"quo&#039;te\"></p>\n", render("%p{ :escaped => 'quo\\'te'}", :attr_wrapper => '"'))
assert_equal("<p escaped='q&#039;uo\"te'></p>\n", render("%p{ :escaped => 'q\\'uo\"te'}", :attr_wrapper => '"'))
assert_equal("<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n", render("!!! XML", :attr_wrapper => '"', :format => :xhtml))
end

@@ -1527,7 +1527,7 @@ def test_html5_data_attributes_without_hyphenation
render("%div{:data => {:one_plus_one => 1+1}}",
:hyphenate_data_attrs => false))

assert_equal("<div data-foo='Here&#x0027;s a \"quoteful\" string.'></div>\n",
assert_equal("<div data-foo='Here&#039;s a \"quoteful\" string.'></div>\n",
render(%{%div{:data => {:foo => %{Here's a "quoteful" string.}}}},
:hyphenate_data_attrs => false)) #'
end
@@ -1691,9 +1691,9 @@ def test_truthy_new_attributes
def test_new_attribute_parsing
assert_equal("<a a2='b2'>bar</a>\n", render("%a(a2=b2) bar", :locals => {:b2 => 'b2'}))
assert_equal(%Q{<a a='foo"bar'>bar</a>\n}, render(%q{%a(a="#{'foo"bar'}") bar})) #'
assert_equal(%Q{<a a="foo'bar">bar</a>\n}, render(%q{%a(a="#{"foo'bar"}") bar})) #'
assert_equal(%Q{<a a='foo&#039;bar'>bar</a>\n}, render(%q{%a(a="#{"foo'bar"}") bar})) #'
assert_equal(%Q{<a a='foo"bar'>bar</a>\n}, render(%q{%a(a='foo"bar') bar}))
assert_equal(%Q{<a a="foo'bar">bar</a>\n}, render(%q{%a(a="foo'bar") bar}))
assert_equal(%Q{<a a='foo&#039;bar'>bar</a>\n}, render(%q{%a(a="foo'bar") bar}))
assert_equal("<a a:b='foo'>bar</a>\n", render("%a(a:b='foo') bar"))
assert_equal("<a a='foo' b='bar'>bar</a>\n", render("%a(a = 'foo' b = 'bar') bar"))
assert_equal("<a a='foo' b='bar'>bar</a>\n", render("%a(a = foo b = bar) bar", :locals => {:foo => 'foo', :bar => 'bar'}))
@@ -1706,8 +1706,8 @@ def test_new_attribute_escaping
assert_equal(%Q{<a a='foo " bar'>bar</a>\n}, render(%q{%a(a="foo \" bar") bar}))
assert_equal(%Q{<a a='foo \\" bar'>bar</a>\n}, render(%q{%a(a="foo \\\\\" bar") bar}))

assert_equal(%Q{<a a="foo ' bar">bar</a>\n}, render(%q{%a(a='foo \' bar') bar}))
assert_equal(%Q{<a a="foo \\' bar">bar</a>\n}, render(%q{%a(a='foo \\\\\' bar') bar}))
assert_equal(%Q{<a a='foo &#039; bar'>bar</a>\n}, render(%q{%a(a='foo \' bar') bar}))
assert_equal(%Q{<a a='foo \\&#039; bar'>bar</a>\n}, render(%q{%a(a='foo \\\\\' bar') bar}))

assert_equal(%Q{<a a='foo \\ bar'>bar</a>\n}, render(%q{%a(a="foo \\\\ bar") bar}))
assert_equal(%Q{<a a='foo \#{1 + 1} bar'>bar</a>\n}, render(%q{%a(a="foo \#{1 + 1} bar") bar}))
@@ -6,7 +6,7 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<strong apos="Foo's bar!">Boo!</strong>
<strong apos='Foo&#039;s bar!'>Boo!</strong>
Embedded? false!
Embedded? true!
Embedded? true!
@@ -61,7 +61,7 @@ testtest
<p class='article quux qux' id='article_1'>Blump</p>
<p class='article' id='foo_bar_baz_article_1'>Whee</p>
Woah inner quotes
<p class='dynamic_quote' dyn='3' quotes="single '"></p>
<p class='dynamic_quote' dyn='3' quotes='single &#039;'></p>
<p class='dynamic_self_closing' dyn='3' />
<body>
hello
@@ -6,7 +6,7 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<strong apos="Foo's bar!">Boo!</strong>
<strong apos='Foo&#039;s bar!'>Boo!</strong>
Embedded? false!
Embedded? true!
Embedded? true!
@@ -61,7 +61,7 @@ Nested content
<p class='article quux qux' id='article_1'>Blump</p>
<p class='article' id='foo_bar_baz_article_1'>Whee</p>
Woah inner quotes
<p class='dynamic_quote' dyn='3' quotes="single '"></p>
<p class='dynamic_quote' dyn='3' quotes='single &#039;'></p>
<p class='dynamic_self_closing' dyn='3' />
<body>
hello

0 comments on commit 18576ae

Please sign in to comment.
You can’t perform that action at this time.