Skip to content
Browse files

m9(xss)<pgr

  • Loading branch information...
1 parent 0403662 commit d68b9eaee88e4c246fbc4d8e1aa7069ea9308f56 @tsuyoshikawa tsuyoshikawa committed Mar 2, 2010
Showing with 12 additions and 9 deletions.
  1. +3 −0 sample2/app.rb
  2. +1 −1 sample2/models.rb
  3. +4 −4 sample2/views/index.erb
  4. +4 −4 sample2/views/user.erb
View
3 sample2/app.rb
@@ -10,6 +10,9 @@
end
helpers do
+ include Rack::Utils
+ alias_method :h, :escape_html
+
def user_authentication
return if session[:ssid].nil?
@user = User.first(:session => {:id => session[:ssid], :expired_at.gte => Time.now})
View
2 sample2/models.rb
@@ -22,7 +22,7 @@ def timeline
def self.password_crypt(plain_text)
Digest::SHA1.hexdigest(PASSWORD_SALT + plain_text)
end
-
+
def password=(plain_text)
attribute_set(:password, User.password_crypt(plain_text))
end
View
8 sample2/views/index.erb
@@ -5,7 +5,7 @@
</p>
<% else %>
<h2>
- こんにちわ!<%= @user.name %>さん
+ こんにちわ!<%= h @user.name %>さん
</h2>
<div id="follow">
フォローしている(<%= @user.followings.count %>)/フォローされている(<%= @user.followers.count %>)
@@ -15,7 +15,7 @@
</p>
<div id="current_user">
<% @current_users.each do |user| %>
-<a href="<%= user.name %>"><%= user.name %></a>/
+<a href="<%= h user.name %>"><%= h user.name %></a>/
<% end %>
</div>
<h3>
@@ -33,10 +33,10 @@
<% @user.timeline.each do |user, tweet| %>
<tr>
<td>
- <a href="<%= user.name %>"><%= user.name %></a>
+ <a href="<%= h user.name %>"><%= h user.name %></a>
</td>
<td>
- <%= tweet.body %>
+ <%= h tweet.body %>
</td>
<td>
<%= tweet.created_at %>
View
8 sample2/views/user.erb
@@ -1,12 +1,12 @@
<p>
- <%= @someone.name %>さんの最近のつぶやきです
+ <%= h @someone.name %>さんの最近のつぶやきです
</p>
<% if login? && @someone.name != @user.name %>
<div id="follow">
<% unless @followed %>
- <a href="/<%= @someone.name %>/follow">フォローする</a>/
+ <a href="/<%= h @someone.name %>/follow">フォローする</a>/
<% else %>
- <a href="/<%= @someone.name %>/remove">リムーブする</a>
+ <a href="/<%= h @someone.name %>/remove">リムーブする</a>
<% end %>
</div>
<% end %>
@@ -16,7 +16,7 @@
<% @someone.tweets.each do |tweet| %>
<tr>
<td>
- <%= tweet.body %>
+ <%= h tweet.body %>
</td>
<td>
<%= tweet.created_at %>

0 comments on commit d68b9ea

Please sign in to comment.
Something went wrong with that request. Please try again.