rails/rails — pull request #14415 by lfittl (2014-03-18 01:54:41+00:00)
Title: Fix html-scanner crash in SanitizeHelper#sanize for empty protocols

As detailed in issue #8126 there is a bug in the vendored html-scanner gem that makes WhiteListSanitizer#contains_bad_protocols? crash when "" is passed to it.

This bugfix is a simple fix in the regular expression of #contains_bad_protocols? in order to only match protocols with at least one character - so that the code does not throw "undefined method `downcase' for nil:NilClass".

We have encountered this kind of HTML in user-generated content, and even though I agree its pretty weird to pass something like that in, there is no other way to avoid this problem for us whilst still sanitizing other tags in the same input.

Fixes #8126.