Navigation

← Previous Changeset
Next Changeset →

Changeset 8255

Timestamp:

12/02/07 08:45:35 (9 months ago)

Author:

nzkoz

Message:

Don't escape forward slashes with String#to_json, our unicode encoding of < and > prevent the XSS problems. [tpope] Closes #10273

Files:

trunk/actionpack/test/template/javascript_helper_test.rb (modified) (4 diffs)
trunk/actionpack/test/template/prototype_helper_test.rb (modified) (3 diffs)
trunk/activesupport/lib/active_support/json/encoders/string.rb (modified) (2 diffs)
trunk/activesupport/test/json/encoding_test.rb (modified) (1 diff)

Legend:

: Unmodified
: Added
: Removed
: Modified
: Copied
: Moved

trunk/actionpack/test/template/javascript_helper_test.rb

r8050	r8255
39	39	page.replace_html 'header', "<h1>Greetings</h1>"
40	40	end
41		assert_dom_equal %(<a href="#" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C\\/h1\\u003E");; return false;">Greet me!</a>), html
	41	assert_dom_equal %(<a href="#" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C/h1\\u003E");; return false;">Greet me!</a>), html
42	42	end
43	43
…	…
46	46	page.replace_html 'header', "<h1>Greetings</h1>"
47	47	end
48		assert_dom_equal %(<a href="#" class="updater" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C\\/h1\\u003E");; return false;">Greet me!</a>), html
	48	assert_dom_equal %(<a href="#" class="updater" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C/h1\\u003E");; return false;">Greet me!</a>), html
49	49	end
50	50
…	…
68	68	page.replace_html 'header', "<h1>Greetings</h1>"
69	69	end
70		assert_dom_equal %(<input type="button" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C\\/h1\\u003E");;" value="Greet me!" />), html
	70	assert_dom_equal %(<input type="button" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C/h1\\u003E");;" value="Greet me!" />), html
71	71	end
72	72
…	…
75	75	page.replace_html 'header', "<h1>Greetings</h1>"
76	76	end
77		assert_dom_equal %(<input type="button" class="greeter" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C\\/h1\\u003E");;" value="Greet me!" />), html
	77	assert_dom_equal %(<input type="button" class="greeter" onclick="Element.update("header", "\\u003Ch1\\u003EGreetings\\u003C\/h1\\u003E");;" value="Greet me!" />), html
78	78	end
79	79

trunk/actionpack/test/template/prototype_helper_test.rb

r8050	r8255
304	304
305	305	def test_insert_html_with_string
306		assert_equal 'new Insertion.Top("element", "\\u003Cp\\u003EThis is a test\\u003C\\/p\\u003E");',
	306	assert_equal 'new Insertion.Top("element", "\\u003Cp\\u003EThis is a test\\u003C/p\\u003E");',
307	307	@generator.insert_html(:top, 'element', '<p>This is a test</p>')
308		assert_equal 'new Insertion.Bottom("element", "\\u003Cp\u003EThis is a test\\u003C\\/p\u003E");',
	308	assert_equal 'new Insertion.Bottom("element", "\\u003Cp\u003EThis is a test\\u003C/p\u003E");',
309	309	@generator.insert_html(:bottom, 'element', '<p>This is a test</p>')
310		assert_equal 'new Insertion.Before("element", "\\u003Cp\u003EThis is a test\\u003C\\/p\u003E");',
	310	assert_equal 'new Insertion.Before("element", "\\u003Cp\u003EThis is a test\\u003C/p\u003E");',
311	311	@generator.insert_html(:before, 'element', '<p>This is a test</p>')
312		assert_equal 'new Insertion.After("element", "\\u003Cp\u003EThis is a test\\u003C\\/p\u003E");',
	312	assert_equal 'new Insertion.After("element", "\\u003Cp\u003EThis is a test\\u003C/p\u003E");',
313	313	@generator.insert_html(:after, 'element', '<p>This is a test</p>')
314	314	end
315	315
316	316	def test_replace_html_with_string
317		assert_equal 'Element.update("element", "\\u003Cp\\u003EThis is a test\\u003C\\/p\\u003E");',
	317	assert_equal 'Element.update("element", "\\u003Cp\\u003EThis is a test\\u003C/p\\u003E");',
318	318	@generator.replace_html('element', '<p>This is a test</p>')
319	319	end
320	320
321	321	def test_replace_element_with_string
322		assert_equal 'Element.replace("element", "\\u003Cdiv id=\"element\"\\u003E\\u003Cp\\u003EThis is a test\\u003C~~\\/p\\u003E\\u003C\\~~/div\\u003E");',
	322	assert_equal 'Element.replace("element", "\\u003Cdiv id=\"element\"\\u003E\\u003Cp\\u003EThis is a test\\u003C/p\\u003E\\u003C/div\\u003E");',
323	323	@generator.replace('element', '<div id="element"><p>This is a test</p></div>')
324	324	end
…	…
357	357
358	358	def test_redirect_to
359		assert_equal 'window.location.href = "http:~~\\/\\/www.example.com\\~~/welcome";',
	359	assert_equal 'window.location.href = "http://www.example.com/welcome";',
360	360	@generator.redirect_to(:action => 'welcome')
361	361	end
…	…
376	376
377	377	assert_equal <<-EOS.chomp, @generator.to_s
378		new Insertion.Top("element", "\\u003Cp\\u003EThis is a test\\u003C\\/p\\u003E");
379		new Insertion.Bottom("element", "\\u003Cp\\u003EThis is a test\\u003C\\/p\\u003E");
	378	new Insertion.Top("element", "\\u003Cp\\u003EThis is a test\\u003C/p\\u003E");
	379	new Insertion.Bottom("element", "\\u003Cp\\u003EThis is a test\\u003C/p\\u003E");
380	380	["foo", "bar"].each(Element.remove);
381		Element.update("baz", "\\u003Cp\\u003EThis is a test\\u003C\\/p\\u003E");
	381	Element.update("baz", "\\u003Cp\\u003EThis is a test\\u003C/p\\u003E");
382	382	EOS
383	383	end

trunk/activesupport/lib/active_support/json/encoders/string.rb

r8050	r8255
12	12	'>' => '\u003E',
13	13	'<' => '\u003C',
14		'&' => '\u0026',
15		'/' => '\\/'
	14	'&' => '\u0026'
16	15	}
17	16	end
…	…
21	20	class String
22	21	def to_json(options = nil) #:nodoc:
23		'"' + gsub(/[\010\f\n\r\t"\\><&\/]/) { \|s\|
	22	'"' + gsub(/[\010\f\n\r\t"\\><&]/) { \|s\|
24	23	ActiveSupport::JSON::Encoding::ESCAPED_CHARS[s]
25	24	}.gsub(/([\xC0-\xDF][\x80-\xBF]\|

trunk/activesupport/test/json/encoding_test.rb

r8050	r8255
16	16	StringTests = [[ 'this is the <string>', %("this is the \\u003Cstring\\u003E")],
17	17	[ 'a "string" with quotes & an ampersand', %("a \\"string\\" with quotes \\u0026 an ampersand") ],
18		[ 'http://test.host/posts/1', %("http:~~\\/\\/test.host\\/posts\\~~/1")]]
	18	[ 'http://test.host/posts/1', %("http://test.host/posts/1")]]
19	19
20	20	ArrayTests = [[ ['a', 'b', 'c'], %([\"a\", \"b\", \"c\"]) ],

Rails Trac