Select tag options untainted

[itschn]

Here's a patch

def content_tag_with_obfuscation(name, content_or_options_with_block = nil, options = nil, *args, &block)
  if block_given?
    content_tag_without_obfuscation(name, content_or_options_with_block, options, *args, &block)
  else
    # this should cover all Rails selects.
    if spinner && options && (options.keys.include?('id') || options.keys.include?('name'))
      if name == 'select' && !content_or_options_with_block.empty?
        # PATCH: add a html safe string
        content = '<option selected value=""></option>'.html_safe
      else
        content = ""
      end
      disguise(content_tag_without_obfuscation(name, content, honeypot_options(options), *args)) +
              content_tag_without_obfuscation(name, content_or_options_with_block, obfuscate_options(options), *args)
    else
      content_tag_without_obfuscation(name, content_or_options_with_block, options, *args)
    end
  end
end

[sinisterchipmunk]

Thanks for this. I'm not ignoring it, just trying to bring the code base up to date first.

[haraldkrischner]

I guess the problem is the same when I use the text_area formhelper?

Looking forward to a fix to this content_tag stuff, thanks

[sinisterchipmunk]

Sorry for the delays here. I've finally gotten the spec suite up to date, so I can test properly under Rails 3. Now rewriting all the old specs (unfortunately, they were pretty tightly coupled to Rails 2.x), and once they're green I hope to close this issue and put out a new release.