zachinglis/crummy

Calling Html_Safe By Default

Closed this issue · 0 comments

In standard_renderer.rb, html_safe is invoked by default .

Shouldn't this be up to the user to mark which strings are html safe?

Example:

add_crumb "safe".html_safe, '/'
add_crumb not_trusted.name, 'not_safe'

For now, it is possible to manually encode text passed into add_crumb, but this seems to go against the convention of encoding by default.