a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
46 lines
1 KiB
Plaintext
46 lines
1 KiB
Plaintext
<?java
|
|
import java.util.*;
|
|
|
|
public class example {
|
|
|
|
public static void main(String[] args) {
|
|
String user = "Erubis";
|
|
String[] list = { "<aaa>", "b&b", "\"ccc\"" };
|
|
StringBuffer _buf = new StringBuffer();
|
|
?>
|
|
<p>Hello @{user}@!</p>
|
|
<table>
|
|
<tbody>
|
|
<?java for (int i = 0; i < list.length; i++) { ?>
|
|
<tr bgcolor="@{i % 2 == 0 ? "#FFCCCC" : "#CCCCFF"}@">
|
|
<td>@!{i + 1}@</td>
|
|
<td>@{list[i]}@</td>
|
|
</tr>
|
|
<?java } ?>
|
|
</tbody>
|
|
</table>
|
|
<?java
|
|
System.out.print(_buf.toString());
|
|
}
|
|
|
|
public static String escape(String s) {
|
|
StringBuffer sb = new StringBuffer();
|
|
for (int i = 0; i < s.length(); i++) {
|
|
char ch = s.charAt(i);
|
|
switch (ch) {
|
|
case '<': sb.append("<"); break;
|
|
case '>': sb.append(">"); break;
|
|
case '&': sb.append("&"); break;
|
|
case '"': sb.append("""); break;
|
|
default: sb.append(ch);
|
|
}
|
|
}
|
|
return sb.toString();
|
|
}
|
|
|
|
public static String escape(int i) {
|
|
return Integer.toString(i);
|
|
}
|
|
}
|
|
?>
|