Permalink
Browse files

properly escape html to avoid invalid utf8 causing XSS attacks

  • Loading branch information...
1 parent 586a944 commit bfc432574d0b141fd7fe759edfe9b6771dd306bd @tenderlove tenderlove committed Aug 16, 2011
@@ -20,7 +20,7 @@ def html_escape(s)
if s.html_safe?
s
else
- s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe
+ s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
end
end
@@ -7,10 +7,17 @@
require 'active_support/core_ext/string'
require 'active_support/time'
require 'active_support/core_ext/string/strip'
+require 'active_support/core_ext/string/output_safety'
class StringInflectionsTest < Test::Unit::TestCase
include InflectorTestCases
+ def test_erb_escape
+ string = [192, 60].pack('CC')
+ expected = 192.chr + "&lt;"
+ assert_equal expected, ERB::Util.html_escape(string)
+ end
+
def test_strip_heredoc_on_an_empty_string
assert_equal '', ''.strip_heredoc
end

0 comments on commit bfc4325

Please sign in to comment.