In actionview, eliminate calls to tag that use html_safe parameter va…

…lues. This is generally unnecessary, since tag handles string quoting, except in one case (utf8_enforcer_tag) where we want to specify the encoding ourselves.
rails · Jun 13, 2014 · 19af434 · bughit · Jul 8, 2015 · bughit
1 parent 6071d62
commit 19af434
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 8 deletions.
diff --git a/actionview/lib/action_view/helpers/form_tag_helper.rb b/actionview/lib/action_view/helpers/form_tag_helper.rb
@@ -794,9 +794,11 @@ def range_field_tag(name, value = nil, options = {})
       end
 
       # Creates the hidden UTF8 enforcer tag. Override this method in a helper
-      # to customize the tag.
+      # to customize the tag.  Note that we have the HTML written out
+      # explicitly here to avoid potential problems with including a
+      # unicode character in output.
       def utf8_enforcer_tag
-        tag(:input, :type => "hidden", :name => "utf8", :value => "&#x2713;".html_safe)
+        %{<input name="utf8" type="hidden" value="&#x2713;" />}.html_safe
       end
 
       private

diff --git a/actionview/lib/action_view/helpers/tags/text_field.rb b/actionview/lib/action_view/helpers/tags/text_field.rb
@@ -7,7 +7,6 @@ def render
           options["size"] = options["maxlength"] unless options.key?("size")
           options["type"] ||= field_type
           options["value"] = options.fetch("value") { value_before_type_cast(object) } unless field_type == "file"
-          options["value"] &&= ERB::Util.html_escape(options["value"])
           add_default_name_and_id(options)
           tag("input", options)
         end

diff --git a/actionview/lib/action_view/helpers/url_helper.rb b/actionview/lib/action_view/helpers/url_helper.rb
@@ -462,20 +462,18 @@ def link_to_if(condition, name, options = {}, html_options = {}, &block)
       #          <strong>Email me:</strong> <span>me@domain.com</span>
       #        </a>
       def mail_to(email_address, name = nil, html_options = {}, &block)
-        email_address = ERB::Util.unwrapped_html_escape(email_address)
-
         html_options, name = name, nil if block_given?
         html_options = (html_options || {}).stringify_keys
 
         extras = %w{ cc bcc body subject }.map! { |item|
           option = html_options.delete(item) || next
           "#{item}=#{Rack::Utils.escape_path(option)}"
         }.compact
-        extras = extras.empty? ? '' : '?' + ERB::Util.unwrapped_html_escape(extras.join('&'))
+        extras = extras.empty? ? '' : '?' + extras.join('&')
 
-        html_options["href"] = "mailto:#{email_address}#{extras}".html_safe
+        html_options["href"] = "mailto:#{email_address}#{extras}"
 
-        content_tag(:a, name || email_address.html_safe, html_options, &block)
+        content_tag(:a, name || email_address, html_options, &block)
       end
 
       # True if the current request URI was generated by the given +options+.