CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3view-helpers
Nate Bird
Nate Bird

Reputation: 5335

stop javascript_include_tag from being escaped

I am upgrading a Rail 3 application and for some reason the line

  <%= javascript_include_tag :defaults %>

produces

&lt;script src=&quot;/javascripts/prototype.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/effects.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/dragdrop.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/controls.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/rails.js?1292866092&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;
&lt;script src=&quot;/javascripts/application.js?1292608980&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt;

Adding a 'raw' infront of the tag works but I'm trying to figure out the real reason why it is doing this. The stylesheet tag above it works fine. I'm confused. Any help?

Upvotes: 1

Views: 530

Answers (2)

Nate Bird
Nate Bird

Reputation: 5335

The culprit was a plugin (semantic_form_builder) that overrides the default rails helpers. I don't think there is an update for it although it shouldn't take much to make it rails3 compatible.

I hope to move to simple_form in the future anyway.

Upvotes: 2

Rishav Rastogi
Rishav Rastogi

Reputation: 15492

Rails 3 automatically escapes html for Xss protection instead of <%= h .. %> which was used in Rails 2.x.

Learn more about it http://railscasts.com/episodes/204-xss-protection-in-rails-3

Upvotes: 1

Related Questions