diff --git a/actionpack/lib/action_view/helpers/text_helper.rb b/actionpack/lib/action_view/helpers/text_helper.rb index 654f3c89f3..c7f96597b9 100644 --- a/actionpack/lib/action_view/helpers/text_helper.rb +++ b/actionpack/lib/action_view/helpers/text_helper.rb @@ -112,13 +112,13 @@ module ActionView end options.reverse_merge!(:highlighter => '\1') - text = h(text) unless text.html_safe? || options[:safe] + text = sanitize(text) unless options[:sanitize] == false if text.blank? || phrases.blank? text else match = Array(phrases).map { |p| Regexp.escape(p) }.join('|') text.gsub(/(#{match})(?!(?:[^<]*?)(?:["'])[^<>]*>)/i, options[:highlighter]) - end + end.html_safe end # Extracts an excerpt from +text+ that matches the first instance of +phrase+. @@ -248,9 +248,9 @@ module ActionView # simple_format("Look ma! A class!", :class => 'description') # # => "
Look ma! A class!
" def simple_format(text, html_options={}, options={}) - text = '' if text.nil? + text = ''.html_safe if text.nil? start_tag = tag('p', html_options, true) - text = h(text) unless text.html_safe? || options[:safe] + text = sanitize(text) unless options[:sanitize] == false text.gsub!(/\r\n?/, "\n") # \r\n and \r -> \n text.gsub!(/\n\n+/, "\n\n#{start_tag}") # 2+ newline -> paragraph text.gsub!(/([^\n]\n)(?=[^\n])/, '\1para 1
\n\npara 2
), simple_format("para 1\n\npara 2", :class => 'test') end - def test_simple_format_should_be_html_safe - assert simple_format(" test with html tags ").html_safe? + def test_simple_format_should_sanitize_input_when_sanitize_option_is_not_false + assert_equal "test with unsafe string
", simple_format(" test with unsafe string ") end - def test_simple_format_should_escape_unsafe_input - assert_equal "<b> test with unsafe string </b><script>code!</script>
", simple_format(" test with unsafe string ") - end - - def test_simple_format_should_not_escape_input_if_safe_option - assert_equal "test with unsafe string
", simple_format(" test with unsafe string ", {}, :safe => true) - end - - def test_simple_format_should_not_escape_safe_input - assert_equal "test with safe string
", simple_format(" test with safe string ".html_safe) + def test_simple_format_should_not_sanitize_input_when_sanitize_option_is_false + assert_equal "test with unsafe string
", simple_format(" test with unsafe string ", {}, :sanitize => false) end def test_truncate_should_not_be_html_safe assert !truncate("Hello World!", :length => 12).html_safe? end - + def test_truncate assert_equal "Hello World!", truncate("Hello World!", :length => 12) assert_equal "Hello Wor...", truncate("Hello World!!", :length => 12) @@ -128,24 +124,17 @@ class TextHelperTest < ActionView::TestCase assert_equal ' ', highlight(' ', 'blank text is returned verbatim') end - def test_highlight_should_escape_unsafe_input + def test_highlight_should_sanitize_input assert_equal( - "This is a beautiful morning<script>code!</script>", + "This is a beautiful morning", highlight("This is a beautiful morning", "beautiful") ) end - def test_highlight_should_not_escape_input_if_safe_option + def test_highlight_should_not_sanitize_if_sanitize_option_if_false assert_equal( "This is a beautiful morning", - highlight("This is a beautiful morning", "beautiful", :safe => true) - ) - end - - def test_highlight_should_not_escape_safe_input - assert_equal( - "This is a beautiful morning", - highlight("This is a beautiful morning".html_safe, "beautiful") + highlight("This is a beautiful morning", "beautiful", :sanitize => false) ) end @@ -179,23 +168,23 @@ class TextHelperTest < ActionView::TestCase def test_highlight_with_html assert_equal( - "<p>This is a beautiful morning, but also a beautiful day</p>", + "This is a beautiful morning, but also a beautiful day
", highlight("This is a beautiful morning, but also a beautiful day
", "beautiful") ) assert_equal( - "<p>This is a <em>beautiful</em> morning, but also a beautiful day</p>", + "This is a beautiful morning, but also a beautiful day
", highlight("This is a beautiful morning, but also a beautiful day
", "beautiful") ) assert_equal( - "<p>This is a <em class="error">beautiful</em> morning, but also a beautiful <span class="last">day</span></p>", + "This is a beautiful morning, but also a beautiful day
", highlight("This is a beautiful morning, but also a beautiful day
", "beautiful") ) assert_equal( - "<p class="beautiful">This is a beautiful morning, but also a beautiful day</p>", + "This is a beautiful morning, but also a beautiful day
", highlight("This is a beautiful morning, but also a beautiful day
", "beautiful") ) assert_equal( - "<p>This is a beautiful <a href="http://example.com/beautiful#top?what=beautiful%20morning&when=now+then">morning</a>, but also a beautiful day</p>", + "This is a beautiful morning, but also a beautiful day
", highlight("This is a beautiful morning, but also a beautiful day
", "beautiful") ) end @@ -317,9 +306,13 @@ class TextHelperTest < ActionView::TestCase end end - def generate_result(link_text, href = nil) + def generate_result(link_text, href = nil, escape = false) href ||= link_text - %{#{CGI::escapeHTML link_text}} + if escape + %{#{CGI::escapeHTML link_text}} + else + %{#{link_text}} + end end def test_auto_link_should_be_html_safe @@ -424,19 +417,14 @@ class TextHelperTest < ActionView::TestCase assert_equal %(#{link10_result} Link
), auto_link("#{link10_raw} Link
") end - def test_auto_link_should_sanitize_unsafe_input + def test_auto_link_should_sanitize_input_when_sanitize_option_is_not_false link_raw = %{http://www.rubyonrails.com?id=1&num=2} - assert_equal %{http://www.rubyonrails.com?id=1&num=2}, auto_link(link_raw) + assert_equal %{http://www.rubyonrails.com?id=1&num=2}, auto_link(link_raw) end - def test_auto_link_should_sanitize_unsafe_input + def test_auto_link_should_not_sanitize_input_when_sanitize_option_is_false link_raw = %{http://www.rubyonrails.com?id=1&num=2} - assert_equal %{http://www.rubyonrails.com?id=1&num=2}, auto_link(link_raw, :safe => true) - end - - def test_auto_link_should_not_sanitize_safe_input - link_raw = %{http://www.rubyonrails.com?id=1&num=2} - assert_equal %{http://www.rubyonrails.com?id=1&num=2}, auto_link(link_raw.html_safe) + assert_equal %{http://www.rubyonrails.com?id=1&num=2}, auto_link(link_raw, :sanitize => false) end def test_auto_link_other_protocols