HTML escaping not working for haml_concat in haml_tag block

[jesk]

HTML escaping does not work when haml_concat is used in a haml_tag block. I reproduced this behaviour in a newly generated rails application (Rails 3.2.15, Ruby 1.9.3-p448, Haml 4.0.2):

Consider the following oneliner view app/views/welcome/index.html.haml:

-haml_concat_test

and the following method in app/helpers/welcome_helper.rb:

module WelcomeHelper
  def haml_concat_test
    haml_concat '<script language="javascript" type="text/javascript">alert("Evil.");</script>'
    haml_tag :p, :class => 'input' do
      haml_concat '<script language="javascript" type="text/javascript">alert("Evil2.");</script>'
      haml_tag :span, '<script language="javascript" type="text/javascript">alert("Evil3.");</script>'
      haml_concat '<b>Bold!</b>'
    end
  end
end

The following HTML will be generated:

<script language="javascript" type="text/javascript">alert("Evil.");</script>
<p class='input'>
  <script language="javascript" type="text/javascript">alert("Evil2.");</script>
  <span>&lt;script language=&quot;javascript&quot; type=&quot;text/javascript&quot;&gt;alert(&quot;Evil3.&quot;);&lt;/script&gt;</span>
  <b>Bold!</b>
</p>

The '<' and '>' chars of the content inside the haml_tag span have been escaped correctly. However the content added with haml_concat has not been escaped. When opening this view the alert "Evil2" pops up and the text 'Bold!' appears bold.

Why doesn't haml escape the contents when using haml_concat inside of a haml_tag block? Do we need to enable escaping globally anywhere?

Thanks a lot in advance,
Jesko

[mmircea16]

This is the correct behavior, haml_concat outputs should not be escaped when are inside a haml_tag block. When xss safe is enabled the haml_tag implementation is the following:

def haml_tag_with_haml_xss(name, *rest, &block)
    name = haml_xss_html_escape(name.to_s)
    rest.unshift(haml_xss_html_escape(rest.shift.to_s)) unless [Symbol, Hash, NilClass].any? {|t| rest.first.is_a? t}
    with_raw_haml_concat {haml_tag_without_haml_xss(name, *rest, &block)}
end

The docs explanation for with_raw_haml_concat is explaining why it is needed.

[norman]

This does seem like a bug. I believe it's happening because the outer call to haml_tag invokes raw_haml_concat, which sets @_haml_concat_raw = true inside the block. Then when haml_concat is called again, the content is simply appended to the buffer with no escaping because @_haml_concat_raw has already been set to true. It would be better to find some way to concat directly with no escaping only for the currently executing block, and not any other blocks that the block might yield to.

[pseidemann]

actually the explanation from @norman applies for #731 but not for this issue. I've created #732 to address the issue stated here as @jesk wrote:

Why doesn't haml escape the contents when using haml_concat inside of a haml_tag block?