FullSantitizer de-escapes escaped HTML entities besides &, <, >
miloprice opened this issue · 3 comments
miloprice commented
If you use FullSanitizer on a string containing an escaped &, <, or >, it remains escaped, as discussed here and added here:
> Rails::Html::FullSanitizer.new.sanitize("Read more & < >")
=> "Read more & < >"
(using version 1.03 with Ruby 2.3.4)
But if you use it on strings containing other escaped characters, they become de-escaped:
> Rails::Html::FullSanitizer.new.sanitize("Read more…")
=> "Read more…"
> Rails::Html::FullSanitizer.new.sanitize("Save 8€ & 5¢")
=> "Save 8€ & 5¢"
Is this intended behavior? Thanks!
kaspth commented
Yes, it is rails/rails#25996 (comment)
miloprice commented
@kaspth The problem I'm having is that it's de-escaping some HTML entities.
& gets escaped and becomes &, and & gets left alone, but … e.g. gets de-escaped and becomes …. Why do & and … behave differently?
kaspth commented
Not sure. I'd check with the Loofah or Nokogiri folks. 😊