Skip to content

Instantly share code, notes, and snippets.

View simianarmy's full-sized avatar

Marc Mauger simianarmy

View GitHub Profile
@simianarmy
simianarmy / rails_xss_gsub_crash
Created October 12, 2011 16:55
rails_xss gsub bug
str = ActiveSupport::SafeBuffer.new "<script>alert</script>"
CGI::unescapeHTML str
=>TypeError: can't dup NilClass
from /Users/marcm/.rvm/rubies/ree-1.8.7-2011.03/lib/ruby/1.8/cgi.rb:371:in `dup'
UnescapeHTML chokes b/c $1 = nil on line 371:
369 def CGI::unescapeHTML(string)
370 string.gsub(/&(amp|quot|gt|lt|\#[0-9]+|\#x[0-9A-Fa-f]+);/n) do
=> 371 match = $1.dup
@simianarmy
simianarmy / Questions
Created September 6, 2011 00:17
GOTO Amsterdam
Day job: Web developer
What is your language of choice: Ruby
Open Source contributions: mogli, cocos2d-javascript
How do you use GitHub: Private repos for work projects, public ones for everything else. Used with Capistrano deploys locally & for EngineYard deployment