Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
  • Loading branch information...
commit 5ed70c591fa086d745b35a16713d91fc0e3ec858 1 parent bee3b7f
Michael Koziarski NZKoz authored tenderlove committed
2  actionpack/lib/action_view/helpers/number_helper.rb
View
@@ -156,7 +156,7 @@ def number_to_currency(number, options = {})
begin
value = number_with_precision(number, options.merge(:raise => true))
- format.gsub(/%n/, value).gsub(/%u/, unit).html_safe
+ format.gsub(/%n/, ERB::Util.html_escape(value)).gsub(/%u/, ERB::Util.html_escape(unit)).html_safe
rescue InvalidNumberError => e
if options[:raise]
raise
7 actionpack/test/template/number_helper_test.rb
View
@@ -43,10 +43,11 @@ def test_number_to_currency
assert_equal("($1,234,567,890.50)", number_to_currency(-1234567890.50, {:negative_format => "(%u%n)"}))
assert_equal("$1,234,567,892", number_to_currency(1234567891.50, {:precision => 0}))
assert_equal("$1,234,567,890.5", number_to_currency(1234567890.50, {:precision => 1}))
- assert_equal("£1234567890,50", number_to_currency(1234567890.50, {:unit => "£", :separator => ",", :delimiter => ""}))
+ assert_equal("£1234567890,50", number_to_currency(1234567890.50, {:unit => raw("£"), :separator => ",", :delimiter => ""}))
+ assert_equal("£1234567890,50", number_to_currency(1234567890.50, {:unit => "£", :separator => ",", :delimiter => ""}))
assert_equal("$1,234,567,890.50", number_to_currency("1234567890.50"))
- assert_equal("1,234,567,890.50 Kč", number_to_currency("1234567890.50", {:unit => "Kč", :format => "%n %u"}))
- assert_equal("1,234,567,890.50 - Kč", number_to_currency("-1234567890.50", {:unit => "Kč", :format => "%n %u", :negative_format => "%n - %u"}))
+ assert_equal("1,234,567,890.50 Kč", number_to_currency("1234567890.50", {:unit => raw("Kč"), :format => "%n %u"}))
+ assert_equal("1,234,567,890.50 - Kč", number_to_currency("-1234567890.50", {:unit => raw("Kč"), :format => "%n %u", :negative_format => "%n - %u"}))
end
def test_number_to_percentage
Please sign in to comment.
Something went wrong with that request. Please try again.