03c135e5fd
This patch was included in the Rails 5.2.x series, but since we haven't upgraded yet, we need to apply it manually.
26 lines
674 B
Ruby
26 lines
674 B
Ruby
# Code taken from https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
|
|
# Remove this code after upgrading to Rails 5.2
|
|
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
|
|
{
|
|
"`" => "\\`",
|
|
"$" => "\\$"
|
|
}
|
|
)
|
|
|
|
module ActionView::Helpers::JavaScriptHelper
|
|
alias :old_ej :escape_javascript
|
|
alias :old_j :j
|
|
|
|
def escape_javascript(javascript)
|
|
javascript = javascript.to_s
|
|
if javascript.empty?
|
|
result = ""
|
|
else
|
|
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
|
|
end
|
|
javascript.html_safe? ? result.html_safe : result
|
|
end
|
|
|
|
alias :j :escape_javascript
|
|
end
|