2 ms·
I was looking for the date when RoR changed their templating so it always output sanitized content and I found this: http://stackoverflow.com/questions/698700/
by batiste 14y ago
I was looking for the date when RoR changed their templating so it always output sanitized content and I found this:
http://stackoverflow.com/questions/698700/escaping-html-in-rails http://stackoverflow.com/questions/698700/escaping-html-in-r...
Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default?
Edit: RoR added auto-escaping around February 2010, Django had it since November 2007
http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/
https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=9 https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...
- grey-area 14y agoYou're wrong. It has auto-escaped since Rails 3. http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/
- rscale 14y agoRails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood. Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.