4 ms·
So why would a currency formatter generate HTML instead of plain text? That seems very strange to me. How does the helper know if I want to use the number in HT
by dave1010uk 13y ago
So why would a currency formatter generate HTML instead of plain text? That seems very strange to me. How does the helper know if I want to use the number in HTML, an email header or even a shell argument? Or are RoR helpers designed to be only usable directly with HTML?
PHP's number_format() doesn't escape for HTML - is that an XSS bug too?
- wilg 13y agoThe view-dependent stuff is in fact separated from the business conversion logic and can be used in a non-web context if you want. Here's the version for use in a view context: https://github.com/rails/rails/blob/master/actionview/lib/action_view/helpers/number_helper.rb#L107 https://github.com/rails/rails/blob/master/actionview/lib/ac... You can see that this method has some XSS prevention logic. Here's the converter itself: https://github.com/rails/rails/blob/master/activesupport/lib/active_support/number_helper/number_to_currency_converter.rb https://github.com/rails/rails/blob/master/activesupport/lib...