Merge pull request #3124 from avakhov/patch-6-stylesheet-link

escape options for the stylesheet_link_tag method

actionpack/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb

@@ -17,7 +17,7 @@ def extension
 
         def asset_tag(source, options)
           # We force the :request protocol here to avoid a double-download bug in IE7 and IE8
-          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => ERB::Util.html_escape(path_to_asset(source, :protocol => :request)) }.merge(options), false, false)
+          tag("link", { "rel" => "stylesheet", "type" => Mime::CSS, "media" => "screen", "href" => path_to_asset(source, :protocol => :request) }.merge(options))
         end
 
         def custom_dir

actionpack/test/template/asset_tag_helper_test.rb

@@ -366,6 +366,10 @@ def test_stylesheet_link_tag_is_html_safe
     assert stylesheet_link_tag('dir/other/file', 'dir/file2').html_safe?
   end
 
+  def test_stylesheet_link_tag_escapes_options
+    assert_dom_equal %(<link href="/file.css" media="&lt;script&gt;" rel="stylesheet" type="text/css" />), stylesheet_link_tag('/file', :media => '<script>')
+  end
+
   def test_custom_stylesheet_expansions
     ENV["RAILS_ASSET_ID"] = ''
     ActionView::Helpers::AssetTagHelper::register_stylesheet_expansion :robbery => ["bank", "robber"]