rails/rails — pull request #7611 by joshuaflanagan (2012-09-12 04:18:54+00:00)
Title: Always encode double quotes in HTML attributes values.

HTML tags generated by `TagHelper#tag` always enclose their attribute values in double quotes ("). Therefore, it never makes sense to allow an unescaped double quote within an attribute value. It shouldn't matter if the attribute value is a `SafeBuffer` (html_safe). It shouldn't matter if the `escape` parameter is `false`. No matter what the caller provides as an attribute value, `#tag` should ensure the HTML it generates properly encloses that value in double quotes.

This is an example failing test:

def test_not_really_safe
assert_equal %(), tag('input', :value => 'supposedly "safe"'.html_safe)
# generates: , and the browser will see the value as "supposedly "
end

Closes issue #7609 (previous pull request sent for 3.2 stable branch)