diff --git a/test/apps/rails2/app/views/other/test_to_i.html.erb b/test/apps/rails2/app/views/other/test_to_i.html.erb index 4e807bb7b398b88fcb05ee175530e2f386fcf0cd..3a530cce4db860017dedd50d3dec30eb26afe64c 100644 --- a/test/apps/rails2/app/views/other/test_to_i.html.erb +++ b/test/apps/rails2/app/views/other/test_to_i.html.erb @@ -3,3 +3,7 @@ <%= request.env[:QUERY_STRING].to_i %> <%= out @id %> + +<%= User.current.age.to_i %> + +<%= out Account.current.number.to_i %> diff --git a/test/tests/test_rails2.rb b/test/tests/test_rails2.rb index f4ebf9f45f7f89fc8e5caa768395b3f00caf5fa8..625175ee79e6286dd32a0797ca510b370a174bc2 100644 --- a/test/tests/test_rails2.rb +++ b/test/tests/test_rails2.rb @@ -815,4 +815,13 @@ class Rails2Tests < Test::Unit::TestCase :confidence => 0, :file => /test_to_i\.html\.erb/ end + + def test_xss_with_model_attribute_to_i + assert_no_warning :type => :template, + :warning_type => "Cross Site Scripting", + :line => 7, + :message => /^Unescaped\ model\ attribute/, + :confidence => 1, + :file => /test_to_i\.html\.erb/ + end end