rails

mirror of https://github.com/github/rails.git synced 2026-04-26 03:00:59 -04:00

Go to file

Michael Koziarski 9415935902 Switch to on-by-default XSS escaping for rails.

This consists of:

  * String#html_safe! a method to mark a string as 'safe'
  * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
  * Calls to String#html_safe! throughout the rails helpers
  * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
  * New ERB implementation based on erubis which uses a SafeBuffer instead of a String

Hat tip to Django for the inspiration.

2009-10-08 09:31:20 +13:00

actionmailer

Prefer tap to returning

2009-09-28 14:38:24 +13:00

actionpack

Switch to on-by-default XSS escaping for rails.

2009-10-08 09:31:20 +13:00

activemodel

Rewrite ActiveModel::Lint as a simple TU mixin

2009-10-07 09:24:51 -05:00

activerecord

Call initialize_copy when cloning [#3164 state:resolved]