[myexperiment-hackers] [2396] trunk/vendor/plugins/acts_as_taggable_redux/lib/ acts_as_taggable_helper.rb: Protect display of tags from html injection vulnerability.

[noreply]

Revision

2396

Author

dtm

Date

2010-04-28 09:40:27 -0400 (Wed, 28 Apr 2010)

Log Message

Protect display of tags from html injection vulnerability.

Modified Paths

• trunk/vendor/plugins/acts_as_taggable_redux/lib/acts_as_taggable_helper.rb

Diff

Modified: trunk/vendor/plugins/acts_as_taggable_redux/lib/acts_as_taggable_helper.rb (2395 => 2396)

--- trunk/vendor/plugins/acts_as_taggable_redux/lib/acts_as_taggable_helper.rb	2010-04-28 10:23:15 UTC (rev 2395)
+++ trunk/vendor/plugins/acts_as_taggable_redux/lib/acts_as_taggable_helper.rb	2010-04-28 13:40:27 UTC (rev 2396)
@@ -1,7 +1,7 @@
 module ActsAsTaggableHelper
   # Create a link to the tag using restful routes and the rel-tag microformat
   def link_to_tag(tag)
-    link_to(tag.name, tag_url(tag), :rel => 'tag')
+    link_to(h(tag.name), tag_url(tag), :rel => 'tag')
   end
   
   # Generate a tag cloud of the top 100 tags by usage, uses the proposed hTagcloud microformat.
@@ -52,15 +52,15 @@
       
       if original
         unless link_to_type.blank?
-          html << link_to(tag.name, tag_url(tag) + "?type=#{link_to_type}", :class => classes[(tag.taggings_count - min) / divisor])
+          html << link_to(h(tag.name), tag_url(tag) + "?type=#{link_to_type}", :class => classes[(tag.taggings_count - min) / divisor])
         else
-          html << link_to(tag.name, tag_url(tag), :class => classes[(tag.taggings_count - min) / divisor])
+          html << link_to(h(tag.name), tag_url(tag), :class => classes[(tag.taggings_count - min) / divisor])
         end
       else
         unless link_to_type.blank?
-          html << "<a href='' class='#{classes[(tag.taggings_count - min) / divisor]}'>#{tag.name}</a>"
+          html << "<a href='' class='#{classes[(tag.taggings_count - min) / divisor]}'>#{h(tag.name)}</a>"
         else
-          html << "<a href='' class='#{classes[(tag.taggings_count - min) / divisor]}'>#{tag.name}</a>"
+          html << "<a href='' class='#{classes[(tag.taggings_count - min) / divisor]}'>#{h(tag.name)}</a>"
         end
       end
       
@@ -75,4 +75,4 @@
     html <<   %(  </ul>\n)
     html <<   %(</div>\n)
   end
-end
\ No newline at end of file
+end