stop javascript_include_tag from being escaped_问答_开发者

stop javascript_include_tag from being escaped

开发者 https://www.devze.com 2023-02-05 13:12 出处：网络

I am upgrading a Rail 3 application and for some reason the line <%= javascript_include_tag :defaults %>开发者_如何学Go;

I am upgrading a Rail 3 application and for some reason the line

  <%= javascript_include_tag :defaults %>开发者_如何学Go;

produces

&lt;script src=&quot;/javascripts/prototype.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/effects.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/dragdrop.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/controls.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/rails.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/application.js?1292608980&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;

Adding a 'raw' infront of the tag works but I'm trying to figure out the real reason why it is doing this. The stylesheet tag above it works fine. I'm confused. Any help?

The culprit was a plugin (semantic_form_builder) that overrides the default rails helpers. I don't think there is an update for it although it shouldn't take much to make it rails3 compatible.

I hope to move to simple_form in the future anyway.

Rails 3 automatically escapes html for Xss protection instead of <%= h .. %> which was used in Rails 2.x.

Learn more about it http://railscasts.com/episodes/204-xss-protection-in-rails-3