Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent html: escaping in broadcast later actions #362

Merged
merged 1 commit into from
Jul 19, 2022

Commits on Jul 19, 2022

  1. Give html: rendering param the same treatment as content:

    broadcast_action_to accepts a content: argument to set the
    turbo-stream template content directly, bypassing any rendering. Other
    params, like partial: or locals:  are delegated to render.
    
    Since the arguments are passed directly to render, you might expect you can
    also use html: as an argument here. However, there's a catch: when using
    a queue system to broadcast the action later, the html_safe flag of
    the html param might be lost in the serialization process. Specifically,
    the flag remains with queue backends that work in process (like `inline` or `async`)
    but it's lost in other that serialize the payload to JSON (like `resque`
    or `sidekiq`).
    
    The resulting effect is that the broadcast action works fine in
    development, but then fails when it's deployed to a production system.
    
    This problem seems to have tripped a few people:
    
    hotwired#284
    
    Treating html: the same as content: solves the issue.
    afcapel committed Jul 19, 2022
    Configuration menu
    Copy the full SHA
    7749c6f View commit details
    Browse the repository at this point in the history