remotipart
remotipart copied to clipboard
Wrong HTML escaping for data type html
https://github.com/JangoSteve/remotipart/blob/master/lib/remotipart/render_overrides.rb#L18
if remotipart_submitted?
textarea_body = response.content_type == 'text/html' ? html_escape(response.body) : response.body
response.body = %{<script type=\"text/javascript\">try{window.parent.document;}catch(err){document.domain=document.domain;}</script> <textarea data-type=\"#{response.content_type}\" data-status=\"#{response.response_code}\" data-statusText=\"#{response.message}\">#{textarea_body}</textarea>}
response.content_type = ::Rails.version >= '5' ? Mime[:html] : Mime::HTML
end
html_escape(response.body)
=> "<div class='b-service-zones__item js-zone' data-id='47'>\n <div class='b-service-zones__item__content'>\n <div class='b-service-zones__item__title'>Тестовая зона приёма</div>\n <div class='b-service-zones__item__category'>Приёмная зона</div>\n </div>\n <div class='b-service-zones__item__actions'>\n <a class="b-service-zones__item__action edit js-link-to-side js-edit spec-zone-edit" data-remote="true" href="/reception_zones/47/edit"></a>\n <a data-type="json" class="b-service-zones__item__action destroy js-destroy" data-remote="true" rel="nofollow" data-method="DELETE" href="/reception_zones/47"></a>\n </div>\n</div>\n"
render_without_remotipart
works for me
Great thank you
Hello. Is there any update with this issue?
When I try
textarea_body = html_escape(response.body)
everything is going fine.
render_without_remotipart
works in Firefox, but not Chrome.
A normal remotipart render with the Remotipart code changed to always escape, as described by Andrey, seems to work on both browsers.