theforeman/foreman — pull request #1580 by eLobato (2014-07-11 08:08:22+00:00)
Title: Fixes #6580 - XSS in operating system name/description (CVE-2014-3531)

The problem here is a misuse of .html_safe
.html_safe just turns the String into a SafeBuffer.

```ruby
> os_name(operatingsystem).html_safe
" TO"
> os_name(operatingsystem).html_safe.class
ActiveSupport::SafeBuffer
```

That doesn't escape anything, but if we append anything to that string, the new string will be escaped.

```ruby
> os_name(operatingsystem).html_safe + ""
" TO<script></script>"
```

It's useful to avoid concatenations of tags, for instance one string ending with "" will not concatenate into a real script.

In short, html_safe does not sanitize the input, it just tells Rails the string is "html_safe", but prevents future concatenations to make it unsafe.

```"#{icon(record, opts)} #{record.to_label}".html_safe``` comes from user input and is not safe.

The current patch assumes 'family' in OS is safe. It does not come from user input but from a hash in the source app/models/operatingsystem.rb so I think it should be OK.