VYPR
Moderate severityNVD Advisory· Published Aug 10, 2012· Updated Apr 29, 2026

CVE-2012-3464

CVE-2012-3464

Description

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
activesupportRubyGems
>= 3.0.0.beta, < 3.0.173.0.17
activesupportRubyGems
>= 3.1.0, < 3.1.83.1.8
activesupportRubyGems
>= 3.2.0, < 3.2.83.2.8
activesupportRubyGems
< 2.3.162.3.16

Affected products

143
  • Rubyonrails/Rails130 versions
    cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*+ 129 more
    • cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*range: <=3.0.16
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*
  • ghsa-coords
    Range: >= 3.0.0.beta, < 3.0.17

Patches

4
d549df7133f2

Squashed commit of the following:

https://github.com/rails/railsAaron PattersonAug 8, 2012via ghsa
1 file changed · +3 3
  • activesupport/lib/active_support/core_ext/string/output_safety.rb+3 3 modified
    @@ -2,13 +2,13 @@
     
     class ERB
       module Util
    -    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;' }
    +    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;', "'" => '&#x27;' }
         JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' }
     
         # A utility method for escaping HTML tag characters.
         # This method is also aliased as <tt>h</tt>.
         #
    -    # In your ERb templates, use this method to escape any unsafe content. For example:
    +    # In your ERB templates, use this method to escape any unsafe content. For example:
         #   <%=h @person.name %>
         #
         # ==== Example:
    @@ -19,7 +19,7 @@ def html_escape(s)
           if s.html_safe?
             s
           else
    -        s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
    +        s.gsub(/[&"'><]/n) { |special| HTML_ESCAPE[special] }.html_safe
           end
         end
     
    
780a718723cf

html_escape should escape single quotes

https://github.com/rails/railsSantiago PastorinoAug 1, 2012via ghsa
10 files changed · +64 35
  • actionpack/test/controller/render_test.rb+2 2 modified
    @@ -149,7 +149,7 @@ def render_text_hello_world
     
       # :ported:
       def render_text_hello_world_with_layout
    -    @variable_for_layout = ", I'm here!"
    +    @variable_for_layout = ", I am here!"
         render :text => "hello world", :layout => true
       end
     
    @@ -776,7 +776,7 @@ def test_render_text
       # :ported:
       def test_do_with_render_text_and_layout
         get :render_text_hello_world_with_layout
    -    assert_equal "<html>hello world, I'm here!</html>", @response.body
    +    assert_equal "<html>hello world, I am here!</html>", @response.body
       end
     
       # :ported:
    
  • actionpack/test/template/asset_tag_helper_test.rb+22 10 modified
    @@ -159,9 +159,11 @@ def url_for(*args)
         %(image_tag("slash..png")) => %(<img alt="Slash." src="/images/slash..png" />),
         %(image_tag(".pdf.png")) => %(<img alt=".pdf" src="/images/.pdf.png" />),
         %(image_tag("http://www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="http://www.rubyonrails.com/images/rails.png" />),
    -    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    -    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    -    %(image_tag("mouse.png", :alt => nil)) => %(<img src="/images/mouse.png" />)
    +    %(image_tag("//www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="//www.rubyonrails.com/images/rails.png" />),
    +    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :alt => nil)) => %(<img src="/images/mouse.png" />),
    +    %(image_tag("data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==", :alt => nil)) => %(<img src="data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" />),
       }
     
       FaviconLinkToTag = {
    @@ -1007,8 +1009,8 @@ def test_should_compute_proper_path
         assert_dom_equal(%(/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse.png'" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse2.png'" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse.png&#x27;" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse2.png&#x27;" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_relative_root_path_on_complete_url
    @@ -1018,11 +1020,21 @@ def test_should_ignore_relative_root_path_on_complete_url
       def test_should_compute_proper_path_with_asset_host
         @controller.config.asset_host = "http://assets.example.com"
         assert_dom_equal(%(<link href="http://www.example.com/collaboration/hieraki" rel="alternate" title="RSS" type="application/rss+xml" />), auto_discovery_link_tag)
    -    assert_dom_equal(%(http://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
    -    assert_dom_equal(%(http://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
    -    assert_dom_equal(%(http://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='http://assets.example.com/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='http://assets.example.com/collaboration/hieraki/images/mouse.png'" src="http://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='http://assets.example.com/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='http://assets.example.com/collaboration/hieraki/images/mouse2.png'" src="http://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +  end
    +
    +  def test_should_compute_proper_path_with_asset_host_and_default_protocol
    +    @controller.config.asset_host = "assets.example.com"
    +    @controller.config.default_asset_host_protocol = :request
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
    +    assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_asset_host_on_complete_url
    
  • actionpack/test/template/erb_util_test.rb+5 5 modified
    @@ -7,11 +7,11 @@ class ErbUtilTest < Test::Unit::TestCase
         define_method "test_html_escape_#{expected.gsub(/\W/, '')}" do
           assert_equal expected, html_escape(given)
         end
    +  end
     
    -    unless given == '"'
    -      define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    -        assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
    -      end
    +  ERB::Util::JSON_ESCAPE.each do |given, expected|
    +    define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    +      assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
         end
       end
     
    @@ -39,7 +39,7 @@ def test_html_escape_passes_html_escpe_unmodified
     
       def test_rest_in_ascii
         (0..127).to_a.map {|int| int.chr }.each do |chr|
    -      next if %w(& " < >).include?(chr)
    +      next if %w(& " < > ').include?(chr)
           assert_equal chr, html_escape(chr)
         end
       end
    
  • actionpack/test/template/form_options_helper_test.rb+3 3 modified
    @@ -887,7 +887,7 @@ def test_time_zone_select_with_default_time_zone_and_value
     
       def test_options_for_select_with_element_attributes
         assert_dom_equal(
    -      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert('Hello World');\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
    +      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert(&#x27;Hello World&#x27;);\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
           options_for_select([ [ "<Denmark>", { :class => 'bold' } ], [ "USA", { :onclick => "alert('Hello World');" } ], [ "Sweden" ], "Germany" ])
         )
       end
    @@ -923,13 +923,13 @@ def test_option_html_attributes_with_single_element_hash
       def test_option_html_attributes_with_multiple_element_hash
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy', 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_multiple_hashes
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy' }, { 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_special_characters
    
  • actionpack/test/template/form_tag_helper_test.rb+1 1 modified
    @@ -361,7 +361,7 @@ def test_stringify_symbol_keys
     
       def test_submit_tag
         assert_dom_equal(
    -      %(<input name='commit' data-disable-with="Saving..." onclick="alert('hello!')" type="submit" value="Save" />),
    +      %(<input name='commit' data-disable-with="Saving..." onclick="alert(&#x27;hello!&#x27;)" type="submit" value="Save" />),
           submit_tag("Save", :disable_with => "Saving...", :onclick => "alert('hello!')")
         )
       end
    
  • actionpack/test/template/javascript_helper_test.rb+5 5 modified
    @@ -41,7 +41,7 @@ def test_escape_javascript_with_safebuffer
       end
     
       def test_button_to_function
    -    assert_dom_equal %(<input type="button" onclick="alert('Hello world!');" value="Greeting" />),
    +    assert_dom_equal %(<input type="button" onclick="alert(&#x27;Hello world!&#x27;);" value="Greeting" />),
           button_to_function("Greeting", "alert('Hello world!')")
       end
     
    @@ -60,7 +60,7 @@ def test_button_to_function_with_rjs_block_and_options
       end
     
       def test_button_to_function_with_onclick
    -    assert_dom_equal "<input onclick=\"alert('Goodbye World :('); alert('Hello world!');\" type=\"button\" value=\"Greeting\" />",
    +    assert_dom_equal "<input onclick=\"alert(&#x27;Goodbye World :(&#x27;); alert(&#x27;Hello world!&#x27;);\" type=\"button\" value=\"Greeting\" />",
           button_to_function("Greeting", "alert('Hello world!')", :onclick => "alert('Goodbye World :(')")
       end
     
    @@ -70,12 +70,12 @@ def test_button_to_function_without_function
       end
     
       def test_link_to_function
    -    assert_dom_equal %(<a href="#" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')")
       end
     
       def test_link_to_function_with_existing_onclick
    -    assert_dom_equal %(<a href="#" onclick="confirm('Sanity!'); alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="confirm(&#x27;Sanity!&#x27;); alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :onclick => "confirm('Sanity!')")
       end
     
    @@ -94,7 +94,7 @@ def test_link_to_function_with_rjs_block_and_options
       end
     
       def test_link_to_function_with_href
    -    assert_dom_equal %(<a href="http://example.com/" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="http://example.com/" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :href => 'http://example.com/')
       end
     
    
  • actionpack/test/template/template_test.rb+1 1 modified
    @@ -50,7 +50,7 @@ def test_basic_template
     
       def test_locals
         @template = new_template("<%= my_local %>")
    -    assert_equal "I'm a local", render(:my_local => "I'm a local")
    +    assert_equal "I am a local", render(:my_local => "I am a local")
       end
     
       def test_restores_buffer
    
  • actionpack/test/template/url_helper_test.rb+5 5 modified
    @@ -188,7 +188,7 @@ def test_link_with_nil_html_options
     
       def test_link_tag_with_custom_onclick
         link = link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')")
    -    expected = %{<a href="http://www.example.com" onclick="alert('yay!')">Hello</a>}
    +    expected = %{<a href="http://www.example.com" onclick="alert(&#x27;yay!&#x27;)">Hello</a>}
         assert_dom_equal expected, link
       end
     
    @@ -198,12 +198,12 @@ def test_link_tag_with_javascript_confirm
           link_to("Hello", "http://www.example.com", :confirm => "Are you sure?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure, can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure, can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure, can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure, can you?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure,\n can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure,\n can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure,\n can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure,\n can you?")
         )
       end
     
    
  • activesupport/lib/active_support/core_ext/string/output_safety.rb+3 3 modified
    @@ -3,13 +3,13 @@
     
     class ERB
       module Util
    -    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;' }
    +    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;', "'" => '&#x27;' }
         JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' }
     
         # A utility method for escaping HTML tag characters.
         # This method is also aliased as <tt>h</tt>.
         #
    -    # In your ERb templates, use this method to escape any unsafe content. For example:
    +    # In your ERB templates, use this method to escape any unsafe content. For example:
         #   <%=h @person.name %>
         #
         # ==== Example:
    @@ -20,7 +20,7 @@ def html_escape(s)
           if s.html_safe?
             s
           else
    -        s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
    +        s.gsub(/[&"'><]/n) { |special| HTML_ESCAPE[special] }.html_safe
           end
         end
     
    
  • activesupport/test/core_ext/string_ext_test.rb+17 0 modified
    @@ -527,6 +527,23 @@ def to_s
         assert string.html_safe?
         assert !string.to_param.html_safe?
       end
    +
    +  test "ERB::Util.html_escape should escape unsafe characters" do
    +    string = '<>&"\''
    +    expected = '&lt;&gt;&amp;&quot;&#x27;'
    +    assert_equal expected, ERB::Util.html_escape(string)
    +  end
    +
    +  test "ERB::Util.html_escape should correctly handle invalid UTF-8 strings" do
    +    string = [192, 60].pack('CC')
    +    expected = 192.chr + "&lt;"
    +    assert_equal expected, ERB::Util.html_escape(string)
    +  end
    +
    +  test "ERB::Util.html_escape should not escape safe strings" do
    +    string = "<b>hello</b>".html_safe
    +    assert_equal string, ERB::Util.html_escape(string)
    +  end
     end
     
     class StringExcludeTest < ActiveSupport::TestCase
    
d0c9759d3aeb

html_escape should escape single quotes

https://github.com/rails/railsSantiago PastorinoAug 1, 2012via ghsa
12 files changed · +51 72
  • actionpack/test/controller/new_base/render_template_test.rb+1 1 modified
    @@ -120,7 +120,7 @@ class TestWithoutLayout < Rack::TestCase
         test "rendering a template with error properly exceprts the code" do
           get :with_error
           assert_status 500
    -      assert_match "undefined local variable or method `idontexist'", response.body
    +      assert_match "undefined local variable or method `idontexist", response.body
         end
       end
     
    
  • actionpack/test/controller/render_test.rb+2 2 modified
    @@ -152,7 +152,7 @@ def render_text_hello_world
     
       # :ported:
       def render_text_hello_world_with_layout
    -    @variable_for_layout = ", I'm here!"
    +    @variable_for_layout = ", I am here!"
         render :text => "hello world", :layout => true
       end
     
    @@ -781,7 +781,7 @@ def test_render_text
       # :ported:
       def test_do_with_render_text_and_layout
         get :render_text_hello_world_with_layout
    -    assert_equal "<html>hello world, I'm here!</html>", @response.body
    +    assert_equal "<html>hello world, I am here!</html>", @response.body
       end
     
       # :ported:
    
  • actionpack/test/template/asset_tag_helper_test.rb+8 8 modified
    @@ -162,8 +162,8 @@ def teardown
         %(image_tag(".pdf.png")) => %(<img alt=".pdf" src="/images/.pdf.png" />),
         %(image_tag("http://www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="http://www.rubyonrails.com/images/rails.png" />),
         %(image_tag("//www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="//www.rubyonrails.com/images/rails.png" />),
    -    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    -    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
         %(image_tag("mouse.png", :alt => nil)) => %(<img src="/images/mouse.png" />),
         %(image_tag("data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==", :alt => nil)) => %(<img src="data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" />),
       }
    @@ -1096,8 +1096,8 @@ def test_should_compute_proper_path
         assert_dom_equal(%(/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse.png'" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse2.png'" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse.png&#x27;" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse2.png&#x27;" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_relative_root_path_on_complete_url
    @@ -1110,8 +1110,8 @@ def test_should_compute_proper_path_with_asset_host
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse2.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_compute_proper_path_with_asset_host_and_default_protocol
    @@ -1120,8 +1120,8 @@ def test_should_compute_proper_path_with_asset_host_and_default_protocol
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse2.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_asset_host_on_complete_url
    
  • actionpack/test/template/erb_util_test.rb+5 5 modified
    @@ -8,11 +8,11 @@ class ErbUtilTest < Test::Unit::TestCase
         define_method "test_html_escape_#{expected.gsub(/\W/, '')}" do
           assert_equal expected, html_escape(given)
         end
    +  end
     
    -    unless given == '"'
    -      define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    -        assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
    -      end
    +  ERB::Util::JSON_ESCAPE.each do |given, expected|
    +    define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    +      assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
         end
       end
     
    @@ -40,7 +40,7 @@ def test_html_escape_passes_html_escpe_unmodified
     
       def test_rest_in_ascii
         (0..127).to_a.map {|int| int.chr }.each do |chr|
    -      next if chr.in?('&"<>')
    +      next if chr.in?('&"<>\'')
           assert_equal chr, html_escape(chr)
         end
       end
    
  • actionpack/test/template/form_options_helper_test.rb+3 3 modified
    @@ -907,7 +907,7 @@ def test_time_zone_select_with_default_time_zone_and_value
     
       def test_options_for_select_with_element_attributes
         assert_dom_equal(
    -      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert('Hello World');\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
    +      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert(&#x27;Hello World&#x27;);\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
           options_for_select([ [ "<Denmark>", { :class => 'bold' } ], [ "USA", { :onclick => "alert('Hello World');" } ], [ "Sweden" ], "Germany" ])
         )
       end
    @@ -943,13 +943,13 @@ def test_option_html_attributes_with_single_element_hash
       def test_option_html_attributes_with_multiple_element_hash
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy', 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_multiple_hashes
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy' }, { 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_special_characters
    
  • actionpack/test/template/form_tag_helper_test.rb+1 1 modified
    @@ -366,7 +366,7 @@ def test_stringify_symbol_keys
     
       def test_submit_tag
         assert_dom_equal(
    -      %(<input name='commit' data-disable-with="Saving..." onclick="alert('hello!')" type="submit" value="Save" />),
    +      %(<input name='commit' data-disable-with="Saving..." onclick="alert(&#x27;hello!&#x27;)" type="submit" value="Save" />),
           submit_tag("Save", :disable_with => "Saving...", :onclick => "alert('hello!')")
         )
       end
    
  • actionpack/test/template/javascript_helper_test.rb+5 5 modified
    @@ -40,12 +40,12 @@ def test_escape_javascript_with_safebuffer
       end
     
       def test_button_to_function
    -    assert_dom_equal %(<input type="button" onclick="alert('Hello world!');" value="Greeting" />),
    +    assert_dom_equal %(<input type="button" onclick="alert(&#x27;Hello world!&#x27;);" value="Greeting" />),
           button_to_function("Greeting", "alert('Hello world!')")
       end
     
       def test_button_to_function_with_onclick
    -    assert_dom_equal "<input onclick=\"alert('Goodbye World :('); alert('Hello world!');\" type=\"button\" value=\"Greeting\" />",
    +    assert_dom_equal "<input onclick=\"alert(&#x27;Goodbye World :(&#x27;); alert(&#x27;Hello world!&#x27;);\" type=\"button\" value=\"Greeting\" />",
           button_to_function("Greeting", "alert('Hello world!')", :onclick => "alert('Goodbye World :(')")
       end
     
    @@ -55,17 +55,17 @@ def test_button_to_function_without_function
       end
     
       def test_link_to_function
    -    assert_dom_equal %(<a href="#" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')")
       end
     
       def test_link_to_function_with_existing_onclick
    -    assert_dom_equal %(<a href="#" onclick="confirm('Sanity!'); alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="confirm(&#x27;Sanity!&#x27;); alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :onclick => "confirm('Sanity!')")
       end
     
       def test_function_with_href
    -    assert_dom_equal %(<a href="http://example.com/" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="http://example.com/" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :href => 'http://example.com/')
       end
     
    
  • actionpack/test/template/template_test.rb+1 1 modified
    @@ -77,7 +77,7 @@ def test_template_does_not_lose_its_source_after_rendering_if_it_does_not_have_a
       def test_locals
         @template = new_template("<%= my_local %>")
         @template.locals = [:my_local]
    -    assert_equal "I'm a local", render(:my_local => "I'm a local")
    +    assert_equal "I am a local", render(:my_local => "I am a local")
       end
     
       def test_restores_buffer
    
  • actionpack/test/template/url_helper_test.rb+5 5 modified
    @@ -193,7 +193,7 @@ def test_link_with_nil_html_options
     
       def test_link_tag_with_custom_onclick
         link = link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')")
    -    expected = %{<a href="http://www.example.com" onclick="alert('yay!')">Hello</a>}
    +    expected = %{<a href="http://www.example.com" onclick="alert(&#x27;yay!&#x27;)">Hello</a>}
         assert_dom_equal expected, link
       end
     
    @@ -203,12 +203,12 @@ def test_link_tag_with_javascript_confirm
           link_to("Hello", "http://www.example.com", :confirm => "Are you sure?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure, can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure, can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure, can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure, can you?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure,\n can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure,\n can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure,\n can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure,\n can you?")
         )
       end
     
    
  • activesupport/lib/active_support/core_ext/string/output_safety.rb+16 37 modified
    @@ -3,45 +3,24 @@
     
     class ERB
       module Util
    -    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;' }
    +    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;', "'" => '&#x27;' }
         JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' }
     
    -    # Detect whether 1.9 can transcode with XML escaping.
    -    if '"&gt;&lt;&amp;&quot;"' == ('><&"'.encode('utf-8', :xml => :attr) rescue false)
    -      # A utility method for escaping HTML tag characters.
    -      # This method is also aliased as <tt>h</tt>.
    -      #
    -      # In your ERB templates, use this method to escape any unsafe content. For example:
    -      #   <%=h @person.name %>
    -      #
    -      # ==== Example:
    -      #   puts html_escape("is a > 0 & a < 10?")
    -      #   # => is a &gt; 0 &amp; a &lt; 10?
    -      def html_escape(s)
    -        s = s.to_s
    -        if s.html_safe?
    -          s
    -        else
    -          s.encode(s.encoding, :xml => :attr)[1...-1].html_safe
    -        end
    -      end
    -    else
    -      # A utility method for escaping HTML tag characters.
    -      # This method is also aliased as <tt>h</tt>.
    -      #
    -      # In your ERB templates, use this method to escape any unsafe content. For example:
    -      #   <%=h @person.name %>
    -      #
    -      # ==== Example:
    -      #   puts html_escape("is a > 0 & a < 10?")
    -      #   # => is a &gt; 0 &amp; a &lt; 10?
    -      def html_escape(s)
    -        s = s.to_s
    -        if s.html_safe?
    -          s
    -        else
    -          s.gsub(/[&"><]/n) { |special| HTML_ESCAPE[special] }.html_safe
    -        end
    +    # A utility method for escaping HTML tag characters.
    +    # This method is also aliased as <tt>h</tt>.
    +    #
    +    # In your ERB templates, use this method to escape any unsafe content. For example:
    +    #   <%=h @person.name %>
    +    #
    +    # ==== Example:
    +    #   puts html_escape("is a > 0 & a < 10?")
    +    #   # => is a &gt; 0 &amp; a &lt; 10?
    +    def html_escape(s)
    +      s = s.to_s
    +      if s.html_safe?
    +        s
    +      else
    +        s.gsub(/[&"'><]/n) { |special| HTML_ESCAPE[special] }.html_safe
           end
         end
     
    
  • activesupport/test/core_ext/string_ext_test.rb+2 2 modified
    @@ -464,8 +464,8 @@ def to_s
       end
     
       test "ERB::Util.html_escape should escape unsafe characters" do
    -    string = '<>&"'
    -    expected = '&lt;&gt;&amp;&quot;'
    +    string = '<>&"\''
    +    expected = '&lt;&gt;&amp;&quot;&#x27;'
         assert_equal expected, ERB::Util.html_escape(string)
       end
     
    
  • railties/test/application/assets_test.rb+2 2 modified
    @@ -232,7 +232,7 @@ class ::PostsController < ActionController::Base ; end
     
           get '/posts'
           assert_match(/AssetNotPrecompiledError/, last_response.body)
    -      assert_match(/app.js isn't precompiled/, last_response.body)
    +      assert_match(/app.js isn&#x27;t precompiled/, last_response.body)
         end
     
         test "assets raise AssetNotPrecompiledError when manifest file is present and requested file isn't precompiled if digest is disabled" do
    @@ -256,7 +256,7 @@ class ::PostsController < ActionController::Base ; end
     
           get '/posts'
           assert_match(/AssetNotPrecompiledError/, last_response.body)
    -      assert_match(/app.js isn't precompiled/, last_response.body)
    +      assert_match(/app.js isn&#x27;t precompiled/, last_response.body)
         end
     
         test "precompile properly refers files referenced with asset_path and and run in the provided RAILS_ENV" do
    
28f2c6f40370

html_escape should escape single quotes

https://github.com/rails/railsSantiago PastorinoAug 1, 2012via ghsa
12 files changed · +51 63
  • actionpack/test/controller/new_base/render_template_test.rb+1 1 modified
    @@ -126,7 +126,7 @@ class TestWithoutLayout < Rack::TestCase
         test "rendering a template with error properly excerts the code" do
           get :with_error
           assert_status 500
    -      assert_match "undefined local variable or method `idontexist'", response.body
    +      assert_match "undefined local variable or method `idontexist", response.body
         end
       end
     
    
  • actionpack/test/controller/render_test.rb+2 2 modified
    @@ -170,7 +170,7 @@ def render_text_hello_world
     
       # :ported:
       def render_text_hello_world_with_layout
    -    @variable_for_layout = ", I'm here!"
    +    @variable_for_layout = ", I am here!"
         render :text => "hello world", :layout => true
       end
     
    @@ -831,7 +831,7 @@ def test_render_text
       # :ported:
       def test_do_with_render_text_and_layout
         get :render_text_hello_world_with_layout
    -    assert_equal "<html>hello world, I'm here!</html>", @response.body
    +    assert_equal "<html>hello world, I am here!</html>", @response.body
       end
     
       # :ported:
    
  • actionpack/test/template/asset_tag_helper_test.rb+8 8 modified
    @@ -162,8 +162,8 @@ def teardown
         %(image_tag(".pdf.png")) => %(<img alt=".pdf" src="/images/.pdf.png" />),
         %(image_tag("http://www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="http://www.rubyonrails.com/images/rails.png" />),
         %(image_tag("//www.rubyonrails.com/images/rails.png")) => %(<img alt="Rails" src="//www.rubyonrails.com/images/rails.png" />),
    -    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    -    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src='/images/mouse_over.png'" onmouseout="this.src='/images/mouse.png'" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
    +    %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(<img alt="Mouse" onmouseover="this.src=&#x27;/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/images/mouse.png&#x27;" src="/images/mouse.png" />),
         %(image_tag("mouse.png", :alt => nil)) => %(<img src="/images/mouse.png" />),
         %(image_tag("data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==", :alt => nil)) => %(<img src="data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==" />),
         %(image_tag("")) => %(<img src="" />)
    @@ -1105,8 +1105,8 @@ def test_should_compute_proper_path
         assert_dom_equal(%(/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse.png'" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='/collaboration/hieraki/images/mouse2.png'" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse.png&#x27;" src="/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;/collaboration/hieraki/images/mouse2.png&#x27;" src="/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_relative_root_path_on_complete_url
    @@ -1119,8 +1119,8 @@ def test_should_compute_proper_path_with_asset_host
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse2.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_compute_proper_path_with_asset_host_and_default_protocol
    @@ -1129,8 +1129,8 @@ def test_should_compute_proper_path_with_asset_host_and_default_protocol
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style"))
         assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png"))
    -    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    -    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png'" onmouseout="this.src='gopher://assets.example.com/collaboration/hieraki/images/mouse2.png'" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
    +    assert_dom_equal(%(<img alt="Mouse" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse.png" />), image_tag("mouse.png", :mouseover => "/images/mouse_over.png"))
    +    assert_dom_equal(%(<img alt="Mouse2" onmouseover="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse_over2.png&#x27;" onmouseout="this.src=&#x27;gopher://assets.example.com/collaboration/hieraki/images/mouse2.png&#x27;" src="gopher://assets.example.com/collaboration/hieraki/images/mouse2.png" />), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png")))
       end
     
       def test_should_ignore_asset_host_on_complete_url
    
  • actionpack/test/template/erb_util_test.rb+5 5 modified
    @@ -8,11 +8,11 @@ class ErbUtilTest < Test::Unit::TestCase
         define_method "test_html_escape_#{expected.gsub(/\W/, '')}" do
           assert_equal expected, html_escape(given)
         end
    +  end
     
    -    unless given == '"'
    -      define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    -        assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
    -      end
    +  ERB::Util::JSON_ESCAPE.each do |given, expected|
    +    define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do
    +      assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given)
         end
       end
     
    @@ -40,7 +40,7 @@ def test_html_escape_passes_html_escpe_unmodified
     
       def test_rest_in_ascii
         (0..127).to_a.map {|int| int.chr }.each do |chr|
    -      next if chr.in?('&"<>')
    +      next if chr.in?('&"<>\'')
           assert_equal chr, html_escape(chr)
         end
       end
    
  • actionpack/test/template/form_options_helper_test.rb+3 3 modified
    @@ -1011,7 +1011,7 @@ def test_time_zone_select_with_default_time_zone_and_value
     
       def test_options_for_select_with_element_attributes
         assert_dom_equal(
    -      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert('Hello World');\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
    +      "<option value=\"&lt;Denmark&gt;\" class=\"bold\">&lt;Denmark&gt;</option>\n<option value=\"USA\" onclick=\"alert(&#x27;Hello World&#x27;);\">USA</option>\n<option value=\"Sweden\">Sweden</option>\n<option value=\"Germany\">Germany</option>",
           options_for_select([ [ "<Denmark>", { :class => 'bold' } ], [ "USA", { :onclick => "alert('Hello World');" } ], [ "Sweden" ], "Germany" ])
         )
       end
    @@ -1047,13 +1047,13 @@ def test_option_html_attributes_with_single_element_hash
       def test_option_html_attributes_with_multiple_element_hash
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy', 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_multiple_hashes
         output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy' }, { 'onclick' => "alert('Hello World');" } ])
         assert output.include?(" class=\"fancy\"")
    -    assert output.include?(" onclick=\"alert('Hello World');\"")
    +    assert output.include?(" onclick=\"alert(&#x27;Hello World&#x27;);\"")
       end
     
       def test_option_html_attributes_with_special_characters
    
  • actionpack/test/template/form_tag_helper_test.rb+1 1 modified
    @@ -368,7 +368,7 @@ def test_stringify_symbol_keys
     
       def test_submit_tag
         assert_dom_equal(
    -      %(<input name='commit' data-disable-with="Saving..." onclick="alert('hello!')" type="submit" value="Save" />),
    +      %(<input name='commit' data-disable-with="Saving..." onclick="alert(&#x27;hello!&#x27;)" type="submit" value="Save" />),
           submit_tag("Save", :disable_with => "Saving...", :onclick => "alert('hello!')")
         )
       end
    
  • actionpack/test/template/javascript_helper_test.rb+5 5 modified
    @@ -46,12 +46,12 @@ def test_escape_javascript_with_safebuffer
       end
     
       def test_button_to_function
    -    assert_dom_equal %(<input type="button" onclick="alert('Hello world!');" value="Greeting" />),
    +    assert_dom_equal %(<input type="button" onclick="alert(&#x27;Hello world!&#x27;);" value="Greeting" />),
           button_to_function("Greeting", "alert('Hello world!')")
       end
     
       def test_button_to_function_with_onclick
    -    assert_dom_equal "<input onclick=\"alert('Goodbye World :('); alert('Hello world!');\" type=\"button\" value=\"Greeting\" />",
    +    assert_dom_equal "<input onclick=\"alert(&#x27;Goodbye World :(&#x27;); alert(&#x27;Hello world!&#x27;);\" type=\"button\" value=\"Greeting\" />",
           button_to_function("Greeting", "alert('Hello world!')", :onclick => "alert('Goodbye World :(')")
       end
     
    @@ -61,17 +61,17 @@ def test_button_to_function_without_function
       end
     
       def test_link_to_function
    -    assert_dom_equal %(<a href="#" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')")
       end
     
       def test_link_to_function_with_existing_onclick
    -    assert_dom_equal %(<a href="#" onclick="confirm('Sanity!'); alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="#" onclick="confirm(&#x27;Sanity!&#x27;); alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :onclick => "confirm('Sanity!')")
       end
     
       def test_function_with_href
    -    assert_dom_equal %(<a href="http://example.com/" onclick="alert('Hello world!'); return false;">Greeting</a>),
    +    assert_dom_equal %(<a href="http://example.com/" onclick="alert(&#x27;Hello world!&#x27;); return false;">Greeting</a>),
           link_to_function("Greeting", "alert('Hello world!')", :href => 'http://example.com/')
       end
     
    
  • actionpack/test/template/template_test.rb+1 1 modified
    @@ -79,7 +79,7 @@ def test_template_does_not_lose_its_source_after_rendering_if_it_does_not_have_a
       def test_locals
         @template = new_template("<%= my_local %>")
         @template.locals = [:my_local]
    -    assert_equal "I'm a local", render(:my_local => "I'm a local")
    +    assert_equal "I am a local", render(:my_local => "I am a local")
       end
     
       def test_restores_buffer
    
  • actionpack/test/template/url_helper_test.rb+5 5 modified
    @@ -194,7 +194,7 @@ def test_link_with_nil_html_options
     
       def test_link_tag_with_custom_onclick
         link = link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')")
    -    expected = %{<a href="http://www.example.com" onclick="alert('yay!')">Hello</a>}
    +    expected = %{<a href="http://www.example.com" onclick="alert(&#x27;yay!&#x27;)">Hello</a>}
         assert_dom_equal expected, link
       end
     
    @@ -204,12 +204,12 @@ def test_link_tag_with_javascript_confirm
           link_to("Hello", "http://www.example.com", :confirm => "Are you sure?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure, can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure, can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure, can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure, can you?")
         )
         assert_dom_equal(
    -      "<a href=\"http://www.example.com\" data-confirm=\"You can't possibly be sure,\n can you?\">Hello</a>",
    -      link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure,\n can you?")
    +      "<a href=\"http://www.example.com\" data-confirm=\"You cant possibly be sure,\n can you?\">Hello</a>",
    +      link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure,\n can you?")
         )
       end
     
    
  • activesupport/lib/active_support/core_ext/string/output_safety.rb+16 28 modified
    @@ -3,36 +3,24 @@
     
     class ERB
       module Util
    -    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;' }
    +    HTML_ESCAPE = { '&' => '&amp;',  '>' => '&gt;',   '<' => '&lt;', '"' => '&quot;', "'" => '&#x27;' }
         JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' }
     
    -    # Detect whether 1.9 can transcode with XML escaping.
    -    if '"&gt;&lt;&amp;&quot;"' == ('><&"'.encode('utf-8', :xml => :attr) rescue false)
    -      # A utility method for escaping HTML tag characters.
    -      # This method is also aliased as <tt>h</tt>.
    -      #
    -      # In your ERB templates, use this method to escape any unsafe content. For example:
    -      #   <%=h @person.name %>
    -      #
    -      # ==== Example:
    -      #   puts html_escape("is a > 0 & a < 10?")
    -      #   # => is a &gt; 0 &amp; a &lt; 10?
    -      def html_escape(s)
    -        s = s.to_s
    -        if s.html_safe?
    -          s
    -        else
    -          s.encode(s.encoding, :xml => :attr)[1...-1].html_safe
    -        end
    -      end
    -    else
    -      def html_escape(s) #:nodoc:
    -        s = s.to_s
    -        if s.html_safe?
    -          s
    -        else
    -          s.gsub(/[&"><]/n) { |special| HTML_ESCAPE[special] }.html_safe
    -        end
    +    # A utility method for escaping HTML tag characters.
    +    # This method is also aliased as <tt>h</tt>.
    +    #
    +    # In your ERB templates, use this method to escape any unsafe content. For example:
    +    #   <%=h @person.name %>
    +    #
    +    # ==== Example:
    +    #   puts html_escape("is a > 0 & a < 10?")
    +    #   # => is a &gt; 0 &amp; a &lt; 10?
    +    def html_escape(s)
    +      s = s.to_s
    +      if s.html_safe?
    +        s
    +      else
    +        s.gsub(/[&"'><]/, HTML_ESCAPE).html_safe
           end
         end
     
    
  • activesupport/test/core_ext/string_ext_test.rb+2 2 modified
    @@ -493,8 +493,8 @@ def to_s
       end
     
       test "ERB::Util.html_escape should escape unsafe characters" do
    -    string = '<>&"'
    -    expected = '&lt;&gt;&amp;&quot;'
    +    string = '<>&"\''
    +    expected = '&lt;&gt;&amp;&quot;&#x27;'
         assert_equal expected, ERB::Util.html_escape(string)
       end
     
    
  • railties/test/application/assets_test.rb+2 2 modified
    @@ -230,7 +230,7 @@ def show_detailed_exceptions?() true end
     
           get '/posts'
           assert_match(/AssetNotPrecompiledError/, last_response.body)
    -      assert_match(/app.js isn't precompiled/, last_response.body)
    +      assert_match(/app.js isn&#x27;t precompiled/, last_response.body)
         end
     
         test "assets raise AssetNotPrecompiledError when manifest file is present and requested file isn't precompiled if digest is disabled" do
    @@ -254,7 +254,7 @@ class ::PostsController < ActionController::Base ; end
     
           get '/posts'
           assert_match(/AssetNotPrecompiledError/, last_response.body)
    -      assert_match(/app.js isn't precompiled/, last_response.body)
    +      assert_match(/app.js isn&#x27;t precompiled/, last_response.body)
         end
     
         test "precompile properly refers files referenced with asset_path and and run in the provided RAILS_ENV" do
    

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.