From 785281ade8c2347614525e9aceb5e62c80eec6f8 Mon Sep 17 00:00:00 2001 From: Gabe da Silveira Date: Mon, 16 Nov 2009 21:17:35 -0800 Subject: [PATCH] Make sure strip_tags removes tags which start with a non-printable character Signed-off-by: Michael Koziarski --- .../vendor/html-scanner/html/node.rb | 2 +- .../test/controller/html-scanner/sanitizer_test.rb | 1 + 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb index 6c03316..0cd05d8 100644 --- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb +++ b/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb @@ -162,7 +162,7 @@ module HTML #:nodoc: end closing = ( scanner.scan(/\//) ? :close : nil ) - return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/) + return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/) name.downcase! unless closing diff --git a/actionpack/test/controller/html-scanner/sanitizer_test.rb b/actionpack/test/controller/html-scanner/sanitizer_test.rb index bae0f5c..51baba6 100644 --- a/actionpack/test/controller/html-scanner/sanitizer_test.rb +++ b/actionpack/test/controller/html-scanner/sanitizer_test.rb @@ -19,6 +19,7 @@ class SanitizerTest < Test::Unit::TestCase assert_equal "This has a here.", sanitizer.sanitize("This has a here.") assert_equal "This has a here.", sanitizer.sanitize("This has a ]]> here.") assert_equal "This has an unclosed ", sanitizer.sanitize("This has an unclosed ]] here...") + assert_equal "non printable char is a tag", sanitizer.sanitize("<\x07a href='/hello'>non printable char is a tag") [nil, '', ' '].each { |blank| assert_equal blank, sanitizer.sanitize(blank) } end -- 1.6.0.1