Permalink
Browse files

Add test select_tag escapes prompt

  • Loading branch information...
1 parent 8f8d8eb commit c8a613b978df82aad8620f109b40f6027cb897a8 @spastorino spastorino committed Aug 3, 2012
Showing with 6 additions and 0 deletions.
  1. +6 −0 actionpack/test/template/form_tag_helper_test.rb
View
6 actionpack/test/template/form_tag_helper_test.rb
@@ -213,6 +213,12 @@ def test_select_tag_with_prompt
assert_dom_equal expected, actual
end
+ def test_select_tag_escapes_prompt
+ actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>"
+ expected = %(<select id="places" name="places"><option value="">&lt;script&gt;alert(1337)&lt;/script&gt;</option><option>Home</option><option>Work</option><option>Pub</option></select>)
+ assert_dom_equal expected, actual
+ end
+
def test_select_tag_with_prompt_and_include_blank
actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true
expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>)

0 comments on commit c8a613b

Please sign in to comment.