1. 04 3月, 2011 1 次提交
  2. 13 2月, 2011 3 次提交
  3. 11 11月, 2010 1 次提交
  4. 17 10月, 2010 1 次提交
  5. 27 9月, 2010 1 次提交
  6. 28 8月, 2010 1 次提交
  7. 27 8月, 2010 1 次提交
  8. 18 7月, 2010 1 次提交
  9. 22 6月, 2010 1 次提交
  10. 20 6月, 2010 1 次提交
  11. 17 6月, 2010 1 次提交
  12. 30 4月, 2010 1 次提交
  13. 29 4月, 2010 1 次提交
  14. 06 3月, 2010 1 次提交
  15. 26 2月, 2010 1 次提交
  16. 25 2月, 2010 1 次提交
  17. 15 2月, 2010 1 次提交
  18. 01 2月, 2010 1 次提交
    • Y
      For performance reasons, you can no longer call html_safe! on Strings.... · 4cbb9db0
      Yehuda Katz 提交于
      For performance reasons, you can no longer call html_safe! on Strings. Instead, all Strings are always not html_safe?. Instead, you can get a SafeBuffer from a String by calling #html_safe, which will SafeBuffer.new(self).
      
        * Additionally, instead of doing concat("</form>".html_safe), you can do
          safe_concat("</form>"), which will skip both the flag set, and the flag
          check.
        * For the first pass, I converted virtually all #html_safe!s to #html_safe,
          and the tests pass. A further optimization would be to try to use
          #safe_concat as much as possible, reducing the performance impact if
          we know up front that a String is safe.
      4cbb9db0
  19. 09 1月, 2010 1 次提交
  20. 08 10月, 2009 1 次提交
    • M
      Switch to on-by-default XSS escaping for rails. · 94159359
      Michael Koziarski 提交于
        This consists of:
      
        * String#html_safe! a method to mark a string as 'safe'
        * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
        * Calls to String#html_safe! throughout the rails helpers
        * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
        * New ERB implementation based on erubis which uses a SafeBuffer instead of a String
      
      Hat tip to Django for the inspiration.
      94159359
  21. 28 9月, 2009 2 次提交
  22. 25 7月, 2009 1 次提交
  23. 05 6月, 2009 2 次提交
  24. 17 4月, 2009 1 次提交
  25. 08 4月, 2009 1 次提交
  26. 16 3月, 2009 1 次提交
  27. 12 3月, 2009 1 次提交
  28. 13 2月, 2009 1 次提交
  29. 17 1月, 2009 1 次提交
  30. 22 12月, 2008 2 次提交
  31. 19 12月, 2008 1 次提交
  32. 16 12月, 2008 1 次提交
  33. 18 11月, 2008 1 次提交
  34. 05 11月, 2008 1 次提交
  35. 22 10月, 2008 1 次提交