Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add 'clear' and 'byteslice' as an unsafe string methods #12054

Closed
wants to merge 1 commit into from
Closed

add 'clear' and 'byteslice' as an unsafe string methods #12054

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion activesupport/lib/active_support/core_ext/string/output_safety.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ module ActiveSupport #:nodoc:
class SafeBuffer < String
UNSAFE_STRING_METHODS = %w(
capitalize chomp chop delete downcase gsub lstrip next reverse rstrip
slice squeeze strip sub succ swapcase tr tr_s upcase prepend
slice squeeze strip sub succ swapcase tr tr_s upcase prepend clear byteslice
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you elaborate on why clear and byteslice should change the html_safe? status of a string? specifically, can you provide examples of an html_safe string that can become non safe because of the usage of these two methods?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

irb(main):046:0> s="asdasd&&&<>".html_safe
=> "asdasd&&&<>"
irb(main):047:0> s.html_safe?
=> true
irb(main):048:0> s.byteslice(8).html_safe?
=> nil
irb(main):053:0> s.byteslice(8..10)
=> "&<>"
irb(main):054:0> s.byteslice(8..10).html_safe?
=> nil

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

irb(main):060:0> s="asasasa".clear.html_safe?
=> false

)

alias_method :original_concat, :concat
Expand Down