Attachment 603414 Details for Bug 847196 – CVE-2012-3463-3-1-select_tag_prompt.patch

[patch] CVE-2012-3463-3-1-select_tag_prompt.patch

CVE-2012-3463-3-1-select_tag_prompt.patch (text/plain), 2.55 KB, created by Kurt Seifried on 2012-08-10 05:02:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-08-10 05:02:14 UTC

Size: 2.55 KB

patch

obsolete

>From d5e99877a576330272afb1056b691c636521b697 Mon Sep 17 00:00:00 2001
>From: Santiago Pastorino <santiago@wyeworks.com>
>Date: Wed, 8 Aug 2012 15:10:35 -0700
>Subject: [PATCH] escape select_tag :prompt values
>
>---
> actionpack/lib/action_view/helpers/form_tag_helper.rb | 4 ++--
> actionpack/test/template/form_tag_helper_test.rb      | 6 ++++++
> 2 files changed, 8 insertions(+), 2 deletions(-)
>
>diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb
>index 838f3a0..4562c5b 100644
>--- a/actionpack/lib/action_view/helpers/form_tag_helper.rb
>+++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb
>@@ -114,11 +114,11 @@ module ActionView
>         html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name
> 
>         if options.delete(:include_blank)
>-          option_tags = "<option value=\"\"></option>".html_safe + option_tags
>+          option_tags = content_tag(:option, '', :value => '').safe_concat(option_tags)
>         end
> 
>         if prompt = options.delete(:prompt)
>-          option_tags = "<option value=\"\">#{prompt}</option>".html_safe + option_tags
>+          option_tags = content_tag(:option, prompt, :value => '').safe_concat(option_tags)
>         end
> 
>         content_tag :select, option_tags, { "name" => html_name, "id" => sanitize_to_id(name) }.update(options.stringify_keys)
>diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb
>index cb36c70..7e1a3f2 100644
>--- a/actionpack/test/template/form_tag_helper_test.rb
>+++ b/actionpack/test/template/form_tag_helper_test.rb
>@@ -206,6 +206,12 @@ class FormTagHelperTest < ActionView::TestCase
>     assert_dom_equal expected, actual
>   end
> 
>+  def test_select_tag_escapes_prompt
>+    actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>"
>+    expected = %(<select id="places" name="places"><option value="">&lt;script&gt;alert(1337)&lt;/script&gt;</option><option>Home</option><option>Work</option><option>Pub</option></select>)
>+    assert_dom_equal expected, actual
>+  end
>+
>   def test_select_tag_with_prompt_and_include_blank
>     actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true
>     expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>)
>-- 
>1.7.11.1
>

Actions: View | Diff

Attachments on bug 847196: 603413 | 603414 | 603415