@@ -, +, @@
---
.../vendor/html-scanner/html/node.rb | 2 +-
.../test/controller/html-scanner/sanitizer_test.rb | 1 +
2 files changed, 2 insertions(+), 1 deletions(-)
--- a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
+++ a/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
@@ -162,7 +162,7 @@ module HTML #:nodoc:
end
closing = ( scanner.scan(/\//) ? :close : nil )
- return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
+ return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/)
name.downcase!
unless closing
--- a/actionpack/test/controller/html-scanner/sanitizer_test.rb
+++ a/actionpack/test/controller/html-scanner/sanitizer_test.rb
@@ -19,6 +19,7 @@ class SanitizerTest < ActionController::TestCase
assert_equal "This has a here.", sanitizer.sanitize("This has a here.")
assert_equal "This has a here.", sanitizer.sanitize("This has a ]]> here.")
assert_equal "This has an unclosed ", sanitizer.sanitize("This has an unclosed ]] here...")
+ assert_equal "non printable char is a tag", sanitizer.sanitize("<\x07a href='/hello'>non printable char is a tag")
[nil, '', ' '].each { |blank| assert_equal blank, sanitizer.sanitize(blank) }
end
--