a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
23 lines
598 B
Plaintext
23 lines
598 B
Plaintext
$ erubis -l js example.ejs
|
|
var _buf = [];
|
|
var user = 'Erubis';
|
|
var list = ['<aaa>', 'b&b', '"ccc"'];
|
|
|
|
_buf.push("<html>\n\
|
|
<body>\n\
|
|
<p>Hello "); _buf.push(user); _buf.push("!</p>\n\
|
|
<table>\n\
|
|
<tbody>\n");
|
|
var i;
|
|
for (i = 0; i < list.length; i++) {
|
|
_buf.push(" <tr bgcolor=\""); _buf.push(i % 2 == 0 ? '#FFCCCC' : '#CCCCFF'); _buf.push("\">\n\
|
|
<td>"); _buf.push(i + 1); _buf.push("</td>\n\
|
|
<td>"); _buf.push(list[i]); _buf.push("</td>\n\
|
|
</tr>\n");
|
|
}
|
|
_buf.push(" </tbody>\n\
|
|
</table>\n\
|
|
</body>\n\
|
|
</html>\n");
|
|
document.write(_buf.join(""));
|