3.0.9 problem with $1, $2, etc. match vars not being set for safe text

[jstraitiff-wk]

There seems to be a problem with regex $ variables and safe text:

ruby-1.9.2-p136 :057 > def linkify_it(txt)
ruby-1.9.2-p136 :058?>   safe_text = ERB::Util::h(txt)
ruby-1.9.2-p136 :059?>   safe_text.gsub(/(^|\s)(https?:\/\/([^\s\/]*)\S*)(\s|$)/i) {|m| puts "safe txt: match '#{m}', $1 '#{$1}', $2 '#{$2}', $3 '#{$3}', $4 '#{$4}'"}
ruby-1.9.2-p136 :060?>   txt.gsub(/(^|\s)(https?:\/\/([^\s\/]*)\S*)(\s|$)/i) {|m| puts "unsafe txt: match '#{m}', $1 '#{$1}', $2 '#{$2}', $3 '#{$3}', $4 '#{$4}'"}
ruby-1.9.2-p136 :061?>   end
 => nil 
ruby-1.9.2-p136 :062 > linkify_it(a)
safe txt: match ' hTTp://google.com ', $1 '', $2 '', $3 '', $4 ''
unsafe txt: match ' hTTp://google.com ', $1 ' ', $2 'hTTp://google.com', $3 'google.com', $4 ' '
 => "try thisit is fun" 
ruby-1.9.2-p136 :063 > a
 => "try this hTTp://google.com it is fun" 
ruby-1.9.2-p136 :064 > linkify_it("try this hTTp://google.com it is fun")
safe txt: match ' hTTp://google.com ', $1 '', $2 '', $3 '', $4 ''
unsafe txt: match ' hTTp://google.com ', $1 ' ', $2 'hTTp://google.com', $3   'google.com', $4 ' '
 => "try thisit is fun" 

So for html_escaped strings, the $ variables are not being set. The used to, i.e. the above code worked fine in 3.0.6

Here’s a gist of the problem:

https://gist.github.com/1030065
git://gist.github.com/1030065.git

[pplr]

Rails 3.1.0.rc4 is also affected by this problem.
Here is a simple test case:

test "gsub" do
  assert_equal("3", "--3--".html_safe.gsub(/--(\d+)--/){$1})
end

[pplr]

Rails 3.1.0.rc4 is also affected by this problem.
Here is a simple test case:

test "gsub" do
  assert_equal("3", "--3--".html_safe.gsub(/--(\d+)--/){$1})
end

[dmathieu]

The problem is $* variables are scoped to the enclosing method.
There's a discussion about this here : http://www.ruby-forum.com/topic/198458

Unfortunately, I'm afraid there's not much that can be done about it.

[dmathieu]

The problem is $* variables are scoped to the enclosing method.
There's a discussion about this here : http://www.ruby-forum.com/topic/198458

Unfortunately, I'm afraid there's not much that can be done about it.

[jstraitiff-wk]

Well, from my perspective, it worked in 3.0.6 and now doesn't in 3.0.9. It works with non-safe strings as I showed above. So it's the rails extensions breaking basic gsub() functionality that is very useful and used.....

So saying "there's not much that can be done" doesn't sit well...

[jstraitiff-wk]

Well, from my perspective, it worked in 3.0.6 and now doesn't in 3.0.9. It works with non-safe strings as I showed above. So it's the rails extensions breaking basic gsub() functionality that is very useful and used.....

So saying "there's not much that can be done" doesn't sit well...

[dmathieu]

It's been changed between 3.0.7 and 3.0.8 because of a security issue.
http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications

html_safe objects are SafeBuffer objects.
This object overrides some unsafe methods, transforming them to strings as they transform the object and therefore, it becomes unsafe.

As gsub transforms the object, it has to be overriden.
Basically, the way of doing your gsub would be to work on unsafe strings. You can get one with to_str

string = "string".html_safe #=> Returns a SafeBuffer object
string.to_str #=> Returns a new string

[dmathieu]

It's been changed between 3.0.7 and 3.0.8 because of a security issue.
http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications

html_safe objects are SafeBuffer objects.
This object overrides some unsafe methods, transforming them to strings as they transform the object and therefore, it becomes unsafe.

As gsub transforms the object, it has to be overriden.
Basically, the way of doing your gsub would be to work on unsafe strings. You can get one with to_str

string = "string".html_safe #=> Returns a SafeBuffer object
string.to_str #=> Returns a new string

[tardate]

NB: just cross-referencing, same issue as #1555
@dmathieu thanks for linking http://www.ruby-forum.com/topic/198458 - best explanation/discussion I've seen of why the magic matching variables break when you attempt to intercept gsub.

[tardate]

NB: just cross-referencing, same issue as #1555
@dmathieu thanks for linking http://www.ruby-forum.com/topic/198458 - best explanation/discussion I've seen of why the magic matching variables break when you attempt to intercept gsub.

[pixeltrix]

Closing as a duplicate of #1555

[pixeltrix]

Closing as a duplicate of #1555