a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
56 lines
1.2 KiB
Plaintext
56 lines
1.2 KiB
Plaintext
<%
|
|
import java.util.*;
|
|
|
|
public class Example {
|
|
private String user;
|
|
private String[] list;
|
|
public example(String user, String[] list) {
|
|
this.user = user;
|
|
this.list = list;
|
|
}
|
|
|
|
public String view() {
|
|
StringBuffer _buf = new StringBuffer();
|
|
%>
|
|
<html>
|
|
<body>
|
|
<p>Hello <%= user %>!</p>
|
|
<table>
|
|
<tbody>
|
|
<% for (int i = 0; i < list.length; i++) { %>
|
|
<tr bgcolor="<%= i % 2 == 0 ? "#FFCCCC" : "#CCCCFF" %>">
|
|
<td><%= i + 1 %></td>
|
|
<td><%== list[i] %></td>
|
|
</tr>
|
|
<% } %>
|
|
</tbody>
|
|
</table>
|
|
<body>
|
|
</html>
|
|
<%
|
|
return _buf.toString();
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
String[] list = { "<aaa>", "b&b", "\"ccc\"" };
|
|
Example ex = Example.new("Erubis", list);
|
|
System.out.print(ex.view());
|
|
}
|
|
|
|
public static String escape(String s) {
|
|
StringBuffer sb = new StringBuffer();
|
|
for (int i = 0; i < s.length(); i++) {
|
|
char ch = s.charAt(i);
|
|
switch (ch) {
|
|
case '<': sb.append("<"); break;
|
|
case '>': sb.append(">"); break;
|
|
case '&': sb.append("&"); break;
|
|
case '"': sb.append("""); break;
|
|
default: sb.append(ch);
|
|
}
|
|
}
|
|
return sb.toString();
|
|
}
|
|
}
|
|
%>
|