Properly escape HTML

Open FooBarWidget opened this issue 12 years ago • 1 comments

Ansi2html uses a rather simplistic way to escape HTML, namely by gsubbing all < with <. However this does not properly escape all HTML. This patch uses ERB::Util.h to properly escape HTML.

I've also upgraded the RSpec dependency to ~> 2.13.0. Older versions of RSpec appear to contain bugs, which cause the tests to fail like this:

6) ANSI2HTML::Main white bold boys have more fun
     Failure/Error: Unable to find matching line from backtrace
          undefined method `run_all' for []:Array
               # /Users/hongli/.rvm/gems/ruby-1.9.3-p429/gems/rspec-core-2.3.1/lib/rspec/core/hooks.rb:116:in `run_hook_filtered'

Also, you should include Gemfile.lock in the repository. The lock file locks down specific versions so that other contributors who run 'bundle install' will get the exact same gem versions as you do, which prevents problems.

Jun 21 '13 11:06 FooBarWidget

Maybe CGI.escapeHTML?

Aug 24 '16 12:08 Nakilon