Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Strip_tags never ending attribute should not raise a TypeError [#4870

…state:resolved]

Signed-off-by: José Valim <jose.valim@gmail.com>
  • Loading branch information...
commit 2002e5877efa40b336b70b707670e734c6389958 1 parent dd8b741
@nono nono authored josevalim committed
View
1  actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
@@ -177,6 +177,7 @@ def parse(parent, line, pos, content, strict=true)
case text
when "\\" then
value << text
+ break if scanner.eos?
value << scanner.getch
when delim
break
View
1  actionpack/lib/action_controller/vendor/html-scanner/html/tokenizer.rb
@@ -96,6 +96,7 @@ def consume_quoted_regions
while match = @scanner.scan_until(/[\\#{delim}]/)
text << match
break if @scanner.matched == delim
+ break if @scanner.eos?
text << @scanner.getch # skip the escaped character
end
end
View
4 actionpack/test/template/html-scanner/sanitizer_test.rb
@@ -257,6 +257,10 @@ def test_should_not_mangle_urls_with_ampersand
assert_sanitized %{<a href=\"http://www.domain.com?var1=1&amp;var2=2\">my link</a>}
end
+ def test_should_sanitize_neverending_attribute
+ assert_sanitized "<span class=\"\\", "<span class=\"\\\">"
+ end
+
protected
def assert_sanitized(input, expected = nil)
@sanitizer ||= HTML::WhiteListSanitizer.new
Please sign in to comment.
Something went wrong with that request. Please try again.