HTML escaping in the 2.3 stable branch

lib/exception_notification/notifier_helper.rb

@@ -24,10 +24,9 @@ module ExceptionNotification::NotifierHelper
  PARAM_FILTER_REPLACEMENT = "[FILTERED]"
 
  def render_section(section)
- RAILS_DEFAULT_LOGGER.info("rendering section #{section.inspect}")
  summary = render("exception_notifier/#{section}").strip
  unless summary.blank?
- title = render("exception_notifier/title", :locals => { :title => section }).strip
+ title = render("exception_notifier/title", :title => section).strip
  "#{title}\n\n#{summary.gsub(/^/, " ")}\n\n"
  end
  end

views/exception_notifier/_backtrace.rhtml

@@ -1 +1 @@
-<%= @backtrace.join "\n" %>
+<%=raw @backtrace.join "\n" %>

views/exception_notifier/_environment.rhtml

@@ -1,7 +1,7 @@
 <% max = @request.env.keys.max { |a,b| a.length <=> b.length } -%>
 <% @request.env.keys.sort.each do |key| -%>
-* <%= "%-*s: %s" % [max.length, key, filter_sensitive_post_data_from_env(key, @request.env[key].to_s.strip)] %>
+* <%=raw "%-*s: %s" % [max.length, key, filter_sensitive_post_data_from_env(key, @request.env[key].to_s.strip)] %>
 <% end -%>
 
-* Process: <%= $$ %>
-* Server : <%= `hostname -s`.chomp %>
+* Process: <%=raw $$ %>
+* Server : <%=raw `hostname -s`.chomp %>

views/exception_notifier/_request.rhtml

@@ -1,4 +1,4 @@
-* URL : <%= @request.protocol %><%= @host %><%= @request.request_uri %>
-* IP address: <%= @request.env["HTTP_X_FORWARDED_FOR"] || @request.env["REMOTE_ADDR"] %>
-* Parameters: <%= filter_sensitive_post_data_parameters(@request.parameters).inspect %>
-* Rails root: <%= @rails_root %>
+* URL : <%=raw @request.url %>
+* IP address: <%=raw @request.remote_ip %>
+* Parameters: <%=raw filter_sensitive_post_data_parameters(@request.parameters).inspect %>
+* Rails root: <%=raw Rails.root %>

views/exception_notifier/_session.rhtml

@@ -1,2 +1,2 @@
-* session id: <%= @request.session_options[:id] %>
-* data: <%= @request.session.inspect %>
+* session id: <%=raw @request.session_options[:id] %>
+* data: <%=raw PP.pp @request.session.inspect.gsub(/\n/, "\n ").strip.html_safe %>

views/exception_notifier/_title.rhtml

@@ -1,3 +1,3 @@
 -------------------------------
-<%= title.to_s.humanize %>:
+<%=raw title.to_s.humanize %>:
 -------------------------------

views/exception_notifier/exception_notification.rhtml

@@ -1,6 +1,6 @@
 A <%= @exception.class %> occurred <%= @exception_source %>:
 
- <%= @exception.message %>
- <%= @backtrace.first %>
+ <%=raw @exception.message %>
+ <%=raw @backtrace.first %>
 
-<%= @sections.map { |section| render_section(section) }.join %>
+<%=raw @sections.map { |section| render_section(section) }.join %>