Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Let strip_tags leave HTML escaping to Rails. #19252

Merged
merged 1 commit into from
Mar 10, 2015
Merged

Let strip_tags leave HTML escaping to Rails. #19252

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ gem 'rake', '>= 10.3'
# ensure correct loading order
gem 'mocha', '~> 0.14', require: false

gem 'rails-html-sanitizer', '~> 1.0.2', github: 'rails/rails-html-sanitizer'

gem 'rack-cache', '~> 1.2'
gem 'jquery-rails', github: 'rails/jquery-rails', branch: 'master'
gem 'coffee-rails', '~> 4.1.0'
Expand Down
14 changes: 10 additions & 4 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,13 @@ GIT
railties (>= 4.2.0)
thor (>= 0.14, < 2.0)

GIT
remote: git://github.com/rails/rails-html-sanitizer.git
revision: 4f0f7810fce6c8aa63de07a40d69d6027a30acaf
specs:
rails-html-sanitizer (1.0.2)
loofah (~> 2.0)

PATH
remote: .
specs:
Expand All @@ -50,13 +57,13 @@ PATH
rack (~> 1.6)
rack-test (~> 0.6.3)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.1)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
actionview (5.0.0.alpha)
activesupport (= 5.0.0.alpha)
builder (~> 3.1)
erubis (~> 2.7.0)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.1)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
activejob (5.0.0.alpha)
activesupport (= 5.0.0.alpha)
globalid (>= 0.3.0)
Expand Down Expand Up @@ -165,8 +172,6 @@ GEM
activesupport (>= 4.2.0.beta, < 5.0)
nokogiri (~> 1.6.0)
rails-deprecated_sanitizer (>= 1.0.1)
rails-html-sanitizer (1.0.1)
loofah (~> 2.0)
rake (10.4.2)
rdoc (4.2.0)
redcarpet (3.2.2)
Expand Down Expand Up @@ -274,6 +279,7 @@ DEPENDENCIES
racc (>= 1.4.6)
rack-cache (~> 1.2)
rails!
rails-html-sanitizer (~> 1.0.2)!
rake (>= 10.3)
redcarpet (~> 3.2.2)
resque
Expand Down
2 changes: 1 addition & 1 deletion actionpack/actionpack.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Gem::Specification.new do |s|

s.add_dependency 'rack', '~> 1.6'
s.add_dependency 'rack-test', '~> 0.6.3'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.1'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.2'
s.add_dependency 'rails-dom-testing', '~> 1.0', '>= 1.0.5'
s.add_dependency 'actionview', version

Expand Down
2 changes: 1 addition & 1 deletion actionview/actionview.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Gem::Specification.new do |s|

s.add_dependency 'builder', '~> 3.1'
s.add_dependency 'erubis', '~> 2.7.0'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.1'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.2'
s.add_dependency 'rails-dom-testing', '~> 1.0', '>= 1.0.5'

s.add_development_dependency 'actionpack', version
Expand Down
2 changes: 1 addition & 1 deletion actionview/lib/action_view/helpers/sanitize_helper.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ def sanitize_css(style)
# strip_tags("<div id='top-bar'>Welcome to my website!</div>")
# # => Welcome to my website!
def strip_tags(html)
self.class.full_sanitizer.sanitize(html)
self.class.full_sanitizer.sanitize(html, encode_special_chars: false)
end

# Strips all link tags from +html+ leaving just the link text.
Expand Down
4 changes: 4 additions & 0 deletions actionview/test/template/sanitize_helper_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,10 @@ def test_strip_tags
assert_equal "", strip_tags("<script>")
end

def test_strip_tags_will_not_encode_special_characters
assert_equal "test\r\n\r\ntest", strip_tags("test\r\n\r\ntest")
end

def test_sanitize_is_marked_safe
assert sanitize("<html><script></script></html>").html_safe?
end
Expand Down