From c47cca2f858f2665a6424e417745a9fd7e78003c Mon Sep 17 00:00:00 2001 From: xibbar Date: Tue, 17 Jul 2012 23:04:46 +0000 Subject: [PATCH] Wed Jul 18 07:59:29 2012 Takeyuki FUJIOKA * lib/cgi/util.rb (CGI.escapeHTML,unescapeHTML): Add ' for HTML5 escaping. [Feature #6620] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@36422 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 5 +++++ lib/cgi/util.rb | 9 ++++++--- test/cgi/test_cgi_util.rb | 8 ++++++++ 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 109c73c208..2db04ed7c9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +Wed Jul 18 07:59:29 2012 Takeyuki FUJIOKA + + * lib/cgi/util.rb (CGI.escapeHTML,unescapeHTML): Add ' for HTML5 escaping. + [Feature #6620] + Tue Jul 17 22:17:13 2012 Tanaka Akira * lib/open-uri.rb: call io.close! for Tempfile. diff --git a/lib/cgi/util.rb b/lib/cgi/util.rb index b877c1bae7..9cfff99b78 100644 --- a/lib/cgi/util.rb +++ b/lib/cgi/util.rb @@ -22,6 +22,7 @@ class CGI # The set of special characters and their escaped values TABLE_FOR_ESCAPE_HTML__ = { + "'" => ''', '&' => '&', '"' => '"', '<' => '<', @@ -32,7 +33,7 @@ class CGI # CGI::escapeHTML('Usage: foo "bar" ') # # => "Usage: foo "bar" <baz>" def CGI::escapeHTML(string) - string.gsub(/[&\"<>]/, TABLE_FOR_ESCAPE_HTML__) + string.gsub(/['&\"<>]/, TABLE_FOR_ESCAPE_HTML__) end # Unescape a string that has been HTML-escaped @@ -41,8 +42,9 @@ class CGI def CGI::unescapeHTML(string) enc = string.encoding if [Encoding::UTF_16BE, Encoding::UTF_16LE, Encoding::UTF_32BE, Encoding::UTF_32LE].include?(enc) - return string.gsub(Regexp.new('&(amp|quot|gt|lt|#[0-9]+|#x[0-9A-Fa-f]+);'.encode(enc))) do + return string.gsub(Regexp.new('&(apos|amp|quot|gt|lt|#[0-9]+|#x[0-9A-Fa-f]+);'.encode(enc))) do case $1.encode("US-ASCII") + when 'apos' then "'".encode(enc) when 'amp' then '&'.encode(enc) when 'quot' then '"'.encode(enc) when 'gt' then '>'.encode(enc) @@ -53,9 +55,10 @@ class CGI end end asciicompat = Encoding.compatible?(string, "a") - string.gsub(/&(amp|quot|gt|lt|\#[0-9]+|\#x[0-9A-Fa-f]+);/) do + string.gsub(/&(apos|amp|quot|gt|lt|\#[0-9]+|\#x[0-9A-Fa-f]+);/) do match = $1.dup case match + when 'apos' then "'" when 'amp' then '&' when 'quot' then '"' when 'gt' then '>' diff --git a/test/cgi/test_cgi_util.rb b/test/cgi/test_cgi_util.rb index a291d47f99..a36af776c5 100644 --- a/test/cgi/test_cgi_util.rb +++ b/test/cgi/test_cgi_util.rb @@ -53,4 +53,12 @@ class CGIUtilTest < Test::Unit::TestCase assert_equal("\n\t\n\t\n\n",CGI::pretty("","\t")) end + def test_cgi_escapeHTML + assert_equal(CGI::escapeHTML("'&\"><"),"'&"><") + end + + def test_cgi_unescapeHTML + assert_equal(CGI::unescapeHTML("'&"><"),"'&\"><") + end + end