3 ms·
Still seems like that is broken. Shouldn't they be escaping whatever control characters? Like if your user wanted to highlight "Now 75% off". Seems like it i
by floxy 3y ago
Still seems like that is broken. Shouldn't they be escaping whatever control characters? Like if your user wanted to highlight "Now 75% off". Seems like it is reasonable to want to allow that.
- tsimionescu 3y agoThat's a completely different problem: it may be too closed. But it's definitely not a fail open system. It's a fail closed system with a bug.
- floxy 3y agoYeah but the real bug is the trying to roll-your-own, instead of using a `ERB.escape_tainted_input` method or somesuch. Either that method doesn't exist, which seems like major mis-feature, or the author didn't know about it, or didn't want to use it.
- wrsh07 3y agoWhoops you are absolutely right!! Good point, I totally misread the if/else.