Calling Html_Safe By Default
Closed this issue · 0 comments
scottwater commented
In standard_renderer.rb, html_safe is invoked by default .
Shouldn't this be up to the user to mark which strings are html safe?
Example:
add_crumb "safe".html_safe, '/'
add_crumb not_trusted.name, 'not_safe'
For now, it is possible to manually encode text passed into add_crumb, but this seems to go against the convention of encoding by default.