Changeset 5321

Timestamp:

10/18/06 15:58:07 (2 years ago)

Author:

rick

Message:

Fix double-escaped entities, such as &, {, etc. [Rick]

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_view/helpers/tag_helper.rb (modified) (2 diffs)
• trunk/actionpack/test/template/tag_helper_test.rb (modified) (1 diff)

trunk/actionpack/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Fix double-escaped entities, such as &, {, etc. [Rick]
-
-* Fix deprecation warnings when rendering the template error template. [Nicholas Seckar]

trunk/actionpack/lib/action_view/helpers/tag_helper.rb

@@ -35 +35 @@
-        def tag_options(options)
-          cleaned_options = convert_booleans(options.stringify_keys.reject {|key, value| value.nil?})
-html_escape(value.to_s
+fix_double_escape(html_escape(value.to_s)
-        end
-
@@ -46 +46 @@
-          options[attribute] ? options[attribute] = attribute : options.delete(attribute)
-        end
+        
+        # Fix double-escaped entities, such as &, {, etc.
+        def fix_double_escape(escaped)
+          escaped.gsub(/&([a-z]+|(#\d+));/i) { "&#{$1};" }
+        end
-    end
-  end

trunk/actionpack/test/template/tag_helper_test.rb

@@ -39 +39 @@
-    assert_equal "<![CDATA[<hello world>]]>", cdata_section("<hello world>")
-  end
+  
+  def test_double_escaping_attributes
+    ['1&amp;2', '1 &lt; 2', '&#8220;test&#8220;'].each do |escaped|
+      assert_equal %(<a href="#{escaped}" />), tag('a', :href => escaped)
+    end
+  end
+  
+  def test_skip_invalid_escaped_attributes
+    ['&1;', '&#1dfa3;', '& #123;'].each do |escaped|
+      assert_equal %(<a href="#{escaped.gsub /&/, '&amp;'}" />), tag('a', :href => escaped)
+    end
+  end
-end