werein/x-editable-rails — pull request #30 by jlaxson (2014-02-01 06:17:45+00:00)
Title: Unsafe use of html_safe in ViewHelpers

I believe there are a few places in view_helper.rb (line 66, 70, and 90) where #html_safe is used on possibly unsanitary user-provided text. It's not clear to me if this actually presents an XSS vulnerability, as some of those values are used as attributes to the tag helper, which presumably will do some escaping of its own. It also depends on the `escape` option to the javascript plugin.

All the same, they look dangerous to me, so here's a proposed fix. This should preserve the ability for values to have embedded HTML and turn off the jQuery plugin's escaping if you really really want. These are untested as I'm just using the builtin GitHub editor. [`safe_join`](http://apidock.com/rails/ActionView/Helpers/OutputSafetyHelper/safe_join) is an ActionView helper that simplifies joining potentially untrusted strings with a trusted (`
` in this case) separator.