Changeset 4911

Timestamp:

09/03/06 00:02:14 (2 years ago)

Author:

rick

Message:

Update sanitize text helper to strip plaintext tags, and <img src=javascript:bang>. [Rick Olson]

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_view/helpers/text_helper.rb (modified) (2 diffs)
• trunk/actionpack/test/template/text_helper_test.rb (modified) (2 diffs)

trunk/actionpack/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Update sanitize text helper to strip plaintext tags, and <img src="javascript:bang">.  [Rick Olson]
-
-* Update routing documentation.  Closes #6017 [Nathan Witmer]

trunk/actionpack/lib/action_view/helpers/text_helper.rb

@@ -169 +169 @@
-      end
-
-
+ plaintext
-      VERBOTEN_ATTRS = /^on/i unless defined?(VERBOTEN_ATTRS)
-
@@ -193 +193 @@
-                  if node.closing != :close
-                    node.attributes.delete_if { |attr,v| attr =~ VERBOTEN_ATTRS }
-if node.attributes["href"] =~ /^javascript:/i
-"href"
+%w(href src).each do |attr|
+attr if node.attributes[attr] =~ /^javascript:/i
-                    end
-                  end

trunk/actionpack/test/template/text_helper_test.rb

@@ -196 +196 @@
-  end
-
+  def test_sanitize_plaintext
+    raw = "<plaintext><span>foo</span></plaintext>"
+    result = sanitize(raw)
+    assert_equal "&lt;plaintext><span>foo</span>&lt;/plaintext>", result
+  end
+
-  def test_sanitize_script
-    raw = "<script language=\"Javascript\">blah blah blah</script>"
@@ -212 +218 @@
-    result = sanitize(raw)
-    assert_equal %{href="javascript:bang" <a name='hello'>foo</a>, <span>bar</span>}, result
+  end
+  
+  def test_sanitize_image_src
+    raw = %{src="javascript:bang" <img src="javascript:bang" width="5">foo</img>, <span src="javascript:bang">bar</span>}
+    result = sanitize(raw)
+    assert_equal %{src="javascript:bang" <img width='5'>foo</img>, <span>bar</span>}, result
-  end
-