comfy/comfortable-mexican-sofa — pull request #151 by holli (2012-02-14 17:57:35+00:00)
Title: injection test added

Extrated test from original pull request 141.

Only test. Implementation was in the original request. Close this if I have gotten this wrong, but:

When I run this test i get

```
1) Failure:
test_escaping_of_parameters(HelperTagTest) [test/unit/tags/helper_test.rb:90]:
<"<%= h('\\'+User.first.inspect+\\'') %>"> expected but was
<"<%= h(''+User.first.inspect+'') %>">.
```

Which in my mind means that if you can write to cms page following
```
{{cms:helper:h:"\'+User.first.inspect +\'"}}
```

Notice the `"\' `-part where user adding extra escaping. The stuff in the middle is excecuted as such without any sanitization.