Changeset 7086

Timestamp:

06/23/07 00:40:53 (1 year ago)

Author:

bitsweat

Message:

Demote Hash#to_xml to use XmlSimple#xml_in_string so it can't read files or stdin. Closes #8453.

Files:

• trunk/activesupport/CHANGELOG (modified) (1 diff)
• trunk/activesupport/lib/active_support/core_ext/hash/conversions.rb (modified) (2 diffs)

trunk/activesupport/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Demote Hash#to_xml to use XmlSimple#xml_in_string so it can't read files or stdin.  #8453 [candlerb, Jeremy Kemper]
-
-* Backport clean_logger changes to support ruby 1.8.2 [mislav]

trunk/activesupport/lib/active_support/core_ext/hash/conversions.rb

@@ -18 +18 @@
-  def to_query(key) #:nodoc:
-    collect { |value| value.to_query("#{key}[]") } * '&'
+  end
+end
+
+# Locked down XmlSimple#xml_in_string
+class XmlSimple
+  # Same as xml_in but doesn't try to smartly shoot itself in the foot.
+  def xml_in_string(string, options = nil)
+    handle_options('in', options)
+
+    @doc = parse(string)
+    result = collapse(@doc.root)
+
+    if @options['keeproot']
+      merge({}, @doc.root.name, result)
+    else
+      result
+    end
+  end
+
+  def self.xml_in_string(string, options = nil)
+    new.xml_in_string(string, options)
-  end
-end
@@ -136 +157 @@
-          def from_xml(xml)
-            # TODO: Refactor this into something much cleaner that doesn't rely on XmlSimple
-
+_string
-              'forcearray'   => false,
-              'forcecontent' => true,