a5e08f7bcc
I installed the rails_xss plugin, for the main purpose of seeing what will break with Rails 3.0 (where the behaviour of the plugin is the default). I think I've fixed everything, but let me know if you see stuff that is HTML-escaped, which shouldn't be. As a side benefit, we now use Erubis, rather than ERB, to render templates. They tell me it's faster ...
57 lines
1.5 KiB
Plaintext
57 lines
1.5 KiB
Plaintext
$ erubis -b -l java example.ejava
|
|
|
|
import java.util.*;
|
|
|
|
public class Example {
|
|
private String user;
|
|
private String[] list;
|
|
public example(String user, String[] list) {
|
|
this.user = user;
|
|
this.list = list;
|
|
}
|
|
|
|
public String view() {
|
|
StringBuffer _buf = new StringBuffer();
|
|
|
|
_buf.append("<html>\n"
|
|
+ " <body>\n"
|
|
+ " <p>Hello "); _buf.append(user); _buf.append("!</p>\n"
|
|
+ " <table>\n"
|
|
+ " <tbody>\n");
|
|
for (int i = 0; i < list.length; i++) {
|
|
_buf.append(" <tr bgcolor=\""); _buf.append(i % 2 == 0 ? "#FFCCCC" : "#CCCCFF"); _buf.append("\">\n"
|
|
+ " <td>"); _buf.append(i + 1); _buf.append("</td>\n"
|
|
+ " <td>"); _buf.append(escape(list[i])); _buf.append("</td>\n"
|
|
+ " </tr>\n");
|
|
}
|
|
_buf.append(" </tbody>\n"
|
|
+ " </table>\n"
|
|
+ " <body>\n"
|
|
+ "</html>\n");
|
|
|
|
return _buf.toString();
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
String[] list = { "<aaa>", "b&b", "\"ccc\"" };
|
|
Example ex = Example.new("Erubis", list);
|
|
System.out.print(ex.view());
|
|
}
|
|
|
|
public static String escape(String s) {
|
|
StringBuffer sb = new StringBuffer();
|
|
for (int i = 0; i < s.length(); i++) {
|
|
char ch = s.charAt(i);
|
|
switch (ch) {
|
|
case '<': sb.append("<"); break;
|
|
case '>': sb.append(">"); break;
|
|
case '&': sb.append("&"); break;
|
|
case '"': sb.append("""); break;
|
|
default: sb.append(ch);
|
|
}
|
|
}
|
|
return sb.toString();
|
|
}
|
|
}
|
|
|