presidentbeef/brakeman — pull request #138 by presidentbeef (2012-08-31 00:49:51+00:00)
Title: Add check for XSS via `content_tag`

`ActionView::Helpers::TagHelper.content_tag` generates an HTML tag. Because of the way it handles its arguments, it is vulnerable to cross-site scripting. Although it has an `escape` argument which is set to `true` by default, that only applies to the HTML attribute *values* which can be supplied.

In Rails 2.x, the content of the tag is unescaped. In Rails 3.x, it is escaped. With the `rails_xss` gem, it is unescaped yet the output is still set to `html_safe`.

Because of this confusion, at least in my head, I made a little diagram:

content_tag :tag, body
^-- Unescaped in Rails 2.x

content_tag, :tag, body, attribute => value
^-- Unescaped in all versions

content_tag, :tag, body, attribute => value
^
|
Escaped by default, can be explicitly escaped
or not by passing in (true|false) as fourth argument