0

This is the code that I have for my posts/index.html.erb file:

<!--
  Iterate over each post in list format
-->
  <% @posts.each do |post| %>       
    <ul class="posts">
    <!--
      Link to article, display date created, show edit, delete links if logged in
    -->
    <li><%= link_to "#{post.title}".html_safe, post, id: "article" %></li>
    <li id="date">  <%= post.created_at.strftime("%B %Y") %></li>

    <% if logged_in? %>
      <li>
        <%= link_to 'Edit', "/editor" + post_path(post), id: "edit_delete", data: {save_url: mercury_update_post_path(post)}  %>
        <%= link_to 'Delete', post, id: "edit_delete", :method => :delete %>    
      </li>
    <% end %>
  </ul>
<% end %>

In my local development and production environments, the associated css stylesheet and html compiles and renders in the browser properly. BUT, when I deploy this code to heroku, it adds some old HTML that I had deleted earlier, as seen in the page source code:

    <!--
    Iterate over each post in list format
-->
            <ul class="posts">
                <!--
                    Link to article, display date created
                -->
                <li>    <a href="/posts/5" id="article"><b>Endurance Exercise is Bad for your Health?</b>
<div><b><br></b></div></a>  </li>
                <li id="date">  February 2013                                   </li>

                    <!--
                        Show edit, delete links if logged in
                    -->
            </ul>

see the <div><b><br></b></div> tags embedded within the link tag for the article "Endurance Exercise is Bad for your Health?" ... Anyone know why that is being put there when deployed to heroku on production?

1 Answer 1

1

This is your culprit. "#{post.title}".html_safe

One of the posts that you are displaying has html tags in its title. It's a bad idea to call .html_safe to anything entered by a user. You should escape that using h(post.title) or sanitize the string first for accepted tags. Look at the sanitize helper

1
  • Thanks, yeah I completely forgot I had put a newline in the title, and since I'm using Mercury editor it translates that newline to <div><b><br></b></div>.
    – kwyoung11
    Feb 26, 2013 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.