Security: Quotes in href are not escaped

[pschyska]

Consider the following:

[2] pry(main)> puts helper.auto_link %{http://"onmouseover='alert(1)'a="a.jpg}
<a href="http://"onmouseover='alert(1)'a="a.jpg">http://"onmouseover='alert(1)'a="a.jpg</a>

In this case, someone could inject a attributes, because the " in the input string closes the href attribute. Shouldn't " be url encoded here?
I didn't find a way to make rails_autolink do that.

Thanks,

Paul

[pschyska]

URI::encode'ing like this pschyska@60fac26 helps. I'm not 100% that that's the correct way to approach this.
Also, I didn't get your test suite to run. Any special requirements for that?

[travisp]

I'm having trouble replicating this:

[22] pry(main)> puts helper.auto_link %{http://"onmouseover='alert(1)'a="a.jpg}
http://"onmouseover='alert(1)'a="a.jpg

is there something I'm missing? Do you have the latest version?

[groe]

Can not replicate this with http://"onmouseover='alert(1)'a="a.jpg