Wrong HTML escaping for data type html

stereodenis commented 7 years ago

https://github.com/JangoSteve/remotipart/blob/master/lib/remotipart/render_overrides.rb#L18

if remotipart_submitted?
    textarea_body = response.content_type == 'text/html' ? html_escape(response.body) : response.body
    response.body = %{<script type=\"text/javascript\">try{window.parent.document;}catch(err){document.domain=document.domain;}</script> <textarea data-type=\"#{response.content_type}\" data-status=\"#{response.response_code}\" data-statusText=\"#{response.message}\">#{textarea_body}</textarea>}
    response.content_type = ::Rails.version >= '5' ? Mime[:html] : Mime::HTML
end

html_escape(response.body)
=> "&lt;div class=&#39;b-service-zones__item js-zone&#39; data-id=&#39;47&#39;&gt;\n  &lt;div class=&#39;b-service-zones__item__content&#39;&gt;\n    &lt;div class=&#39;b-service-zones__item__title&#39;&gt;Тестовая зона приёма&lt;/div&gt;\n    &lt;div class=&#39;b-service-zones__item__category&#39;&gt;Приёмная зона&lt;/div&gt;\n  &lt;/div&gt;\n  &lt;div class=&#39;b-service-zones__item__actions&#39;&gt;\n    &lt;a class=&quot;b-service-zones__item__action edit js-link-to-side js-edit spec-zone-edit&quot; data-remote=&quot;true&quot; href=&quot;/reception_zones/47/edit&quot;&gt;&lt;/a&gt;\n    &lt;a data-type=&quot;json&quot; class=&quot;b-service-zones__item__action destroy js-destroy&quot; data-remote=&quot;true&quot; rel=&quot;nofollow&quot; data-method=&quot;DELETE&quot; href=&quot;/reception_zones/47&quot;&gt;&lt;/a&gt;\n  &lt;/div&gt;\n&lt;/div&gt;\n"

render_without_remotipart works for me

leoduquesnel commented 7 years ago

Great thank you

DemidenkoAndrey commented 7 years ago

Hello. Is there any update with this issue? When I try
textarea_body = html_escape(response.body) everything is going fine.

mrj commented 7 years ago

render_without_remotipart works in Firefox, but not Chrome.

A normal remotipart render with the Remotipart code changed to always escape, as described by Andrey, seems to work on both browsers.

JangoSteve / remotipart

Wrong HTML escaping for data type html #176