text_field, text_area and other basic helpers are beeing escaped

NZKoz / rails_xss

A plugin for rails 2.3.5 applications which switches the default to escape by default. Later versions should use rails/rails_xss

MIT License

215 stars 39 forks source link

text_field, text_area and other basic helpers are beeing escaped #21

Open localguiding opened 13 years ago

localguiding commented 13 years ago

Hi, Currently some helpers like f.text_field are been escaped, why ? I have installed erubis before plugin, should I configure erubis to work together with this plugin some way ? Thanks in advance.

ps: rails 2.3.5

brendon commented 13 years ago

Seeing this too. I'm hoping I've done something wrong. Any advice? f.label isn't being escaped but f.text_field is. f.check_box isn't.

Weird.

brendon commented 13 years ago

Very obscure. If you're using mislav's standarista plugin to output HTML tags instead of XHTML then this will trip you up if you haven't upgraded to the latest version of that plugin. I only twigged when I ran the rails_xss tests and noticed that many failed due to the lack of XML style self closing tags in my output. Hope this helps someone else in the future :)