ActiveSupport::SafeBuffer#prepend inconsistency

[rwz]

Native ruby String#prepend modifies instance in-place, while ActiveSupport::SafeBuffer returns modified version, but the initial object remains unchanged.

a = "bar"           # => "bar"
a.prepend "foo"     # => "foobar"
a                   # => "foobar"
b = "bar".html_safe # => "bar"
b.class             # => ActiveSupport::SafeBuffer
b.prepend "foo"     # => "foobar"
b                   # => "bar", expected "foobar"

[ming-kernel]

unto should be onto?

[rwz]

@ming-kernel Yep, you're right. Thanks!

[rafaelfranca]

I don't think prepend should even mark an string html safe. We are changing the behavior and also we may opening a XSS vector.

[rwz]

@rafaelfranca this is how #concat currently works. I guess it'd make sense to use the same behavior for #prepend

[rwz]

What's the status of this? Are we waiting for someone to make a decision or an alternative implementation to show up?

[rafaelfranca]

Sorry, many issues to handle. It is missing CHANGELOG

[rwz]

Ah, alright, will add changelog then.

[rwz]

Done.

[rafaelfranca]

We should not remove prepend! without a deprecation message. Mind to add it?

[rwz]

ok

[rwz]

Done.

[rafaelfranca]

Thank you. I'll merge it

[matthewd]

Do we want #concat to be defined via define_method? What about extracting the commonality via a helper...

def concat(value)
  super(maybe_escape(value))
end

def prepend(value)
  super(maybe_escape(value))
end

private
def maybe_escape(value)
  if html_safe? && !value.html_safe?
    ERB::Util.h(value)
  else
    value
  end
end

wdyt?

[rwz]

@matthewd that'll produce two separate methods with exact same implementation, which might be even more confusing than a define_method approach. Also, I was reluctant to introduce another helper method on a global class just for that.

[matthewd]

Hmm, I just realised there's actually already html_escape_interpolated_argument.

As for visually matching methods, I personally don't think that's particularly confusing -- especially when the very first word of the method body is 'super'... but I'm just thinking out loud. It's up to @rafaelfranca which he prefers. And the one that someone cared enough to make, sure has a certain argument over my bikeshedding. 💙

[rwz]

I've added a commit to make use of this helper effectively DRYing the code. Thanks, good catch.

[carlosantoniodasilva]

Shouldn't the require be on the actual file rather than the test?

[rafaelfranca]

👍. Fixing