Cannot modify SafeBuffer in place - with yield

[lphm]

Hello

After I have updated rails to 3.0.8, I got this error :
Cannot modify SafeBuffer in place

This error arrives on this code :
<%= strip_tags(yield(:page_title)) %>

I have installed rails 3.0.9 but I have the same error.

How can I resolve this problem ?
Thanks for your help.

[lphm]

To add precisions on this error, I have no errors when :page_title contains HTML tags but error arrives when :page_title does not contain HTML tags.

[iain]

yield(:page_title) returns an html safe string. The strip_tags methods changes this string in place. It shouldn't do that, it should return a new string object, not modify the old one.

So this is a valid issue imho.

A workaround is to make the string unsafe again:

<%= strip_tags(yield(:page_title).untrust)) %>

[lphm]

It does not work.

I use strip_tags here because I show page title twice, in TITLE tag and in H1 tag. The :page_title into TITLE tag must be without html tags.

<title><%= strip_tags(yield(:page_title).untrust) %></title>
...
<h1><%= yield :page_title %></h1>

[cabgfx]

I have the exact same issue on 3.0.9 - my code is literally the same as @lphm: <%= strip_tags(yield(:page_title)) %>.
I also yield :page_title to both the <title> tag (where HTML should be stripped) and to headings within the view, eg. <h1>.

Making the string unsafe again with untrust, as suggested by @iain, does not work here as well.

[cabgfx]

The solution seems to have been provided already by @tenderlove in this security announcement;

Any methods that mutate the safe buffer without escaping input will now raise an exception.
If you need to modify a safe buffer, cast it to a Ruby string first by calling the to_str method:

This works for me:
<%= strip_tags(yield(:page_title).to_str) %>

[wapcaplet]

I was bitten by this too. I agree with @iain that the real problem here is that strip_tags sometimes behaves like strip_tags! -- attempting to modify the string in place when it should only be working with a copy. I believe the offending code is in action_controller/vendor/html-scanner/html/sanitizer.rb, specifically within HTML::Sanitizer#sanitize, called by HTML::FullSanitizer#sanitize:

class FullSanitizer < Sanitizer
  def sanitize(text, options = {})
    result = super     # <-- Assumes that `result` is a copy of `text` now ...
    result.gsub!( ... ) # <-- ... because it's modified in-place here
    # ...

However, there's no guarantee that super returns a copy, because here's the super (Sanitizer#sanitize):

def sanitize(text, options = {})
  return text unless sanitizeable?(text) # <-- No copy made in this case
  # ...

If text does not need sanitizing (that is, it's empty, or has no HTML tags in it), then sanitizeable? returns false. So text is passed right back to FullSanitizer#sanitize, which blithely proceeds to run gsub! on some text that doesn't need sanitizing (and, in the case of a SafeBuffer, does not allow gsub! to be called on it in the first place).

Edit: I just noticed that this was recently fixed, so I'll quit complaining now :-)

[waseem]

This can be closed now.

[arunagw]

@lphm Can you confirm please??

[lphm]

Yes, this can be closed.

Thanks for your help. ++++