mirrors
/
rails
mirror of https://github.com/rails/rails
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

Let strip_tags leave HTML escaping to Rails. 

Prevents double escaping errors, such as "&" becoming "&".
This commit is contained in:
Kasper Timm Hansen 2015-03-07 18:48:06 +01:00
parent 96b8f401f5
commit 37695b8aab
6 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Gemfile
View File

@ -10,6 +10,8 @@ gem 'rake', '>= 10.3'
# ensure correct loading order
gem 'mocha', '~> 0.14', require: false
gem 'rails-html-sanitizer', '~> 1.0.2', github: 'rails/rails-html-sanitizer'
gem 'rack-cache', '~> 1.2'
gem 'jquery-rails', github: 'rails/jquery-rails', branch: 'master'
gem 'coffee-rails', '~> 4.1.0'

14
Gemfile.lock
View File

@ -35,6 +35,13 @@ GIT
railties (>= 4.2.0)
thor (>= 0.14, < 2.0)
GIT
remote: git://github.com/rails/rails-html-sanitizer.git
revision: 4f0f7810fce6c8aa63de07a40d69d6027a30acaf
specs:
rails-html-sanitizer (1.0.2)
loofah (~> 2.0)
PATH
remote: .
specs:
@ -50,13 +57,13 @@ PATH
rack (~> 1.6)
rack-test (~> 0.6.3)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.1)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
actionview (5.0.0.alpha)
activesupport (= 5.0.0.alpha)
builder (~> 3.1)
erubis (~> 2.7.0)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.1)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
activejob (5.0.0.alpha)
activesupport (= 5.0.0.alpha)
globalid (>= 0.3.0)
@ -165,8 +172,6 @@ GEM
activesupport (>= 4.2.0.beta, < 5.0)
nokogiri (~> 1.6.0)
rails-deprecated_sanitizer (>= 1.0.1)
rails-html-sanitizer (1.0.1)
loofah (~> 2.0)
rake (10.4.2)
rdoc (4.2.0)
redcarpet (3.2.2)
@ -274,6 +279,7 @@ DEPENDENCIES
racc (>= 1.4.6)
rack-cache (~> 1.2)
rails!
rails-html-sanitizer (~> 1.0.2)!
rake (>= 10.3)
redcarpet (~> 3.2.2)
resque

2
actionpack/actionpack.gemspec
View File

@ -23,7 +23,7 @@ Gem::Specification.new do |s|
s.add_dependency 'rack', '~> 1.6'
s.add_dependency 'rack-test', '~> 0.6.3'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.1'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.2'
s.add_dependency 'rails-dom-testing', '~> 1.0', '>= 1.0.5'
s.add_dependency 'actionview', version

2
actionview/actionview.gemspec
View File

@ -23,7 +23,7 @@ Gem::Specification.new do |s|
s.add_dependency 'builder', '~> 3.1'
s.add_dependency 'erubis', '~> 2.7.0'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.1'
s.add_dependency 'rails-html-sanitizer', '~> 1.0', '>= 1.0.2'
s.add_dependency 'rails-dom-testing', '~> 1.0', '>= 1.0.5'
s.add_development_dependency 'actionpack', version

2
actionview/lib/action_view/helpers/sanitize_helper.rb
View File

@ -99,7 +99,7 @@ module ActionView
# strip_tags("<div id='top-bar'>Welcome to my website!</div>")
# # => Welcome to my website!
def strip_tags(html)
self.class.full_sanitizer.sanitize(html)
self.class.full_sanitizer.sanitize(html, encode_special_chars: false)
end
# Strips all link tags from +html+ leaving just the link text.

4
actionview/test/template/sanitize_helper_test.rb
View File

@ -29,6 +29,10 @@ class SanitizeHelperTest < ActionView::TestCase
assert_equal "", strip_tags("<script>")
end
def test_strip_tags_will_not_encode_special_characters
assert_equal "test\r\n\r\ntest", strip_tags("test\r\n\r\ntest")
end
def test_sanitize_is_marked_safe
assert sanitize("<html><script></script></html>").html_safe?
end