Skip to content

Instantly share code, notes, and snippets.

@vanderhoorn
vanderhoorn / rails-2-3-14-select_options.rb
Created March 23, 2012 20:05
Monkey patch for the "XSS Vulnerability in the select helper"
# A Rails 2.3.14 monkey patch for the "XSS Vulnerability in the select helper", as reported in:
# http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664
#
module ActionView
module Helpers
class InstanceTag #:nodoc:
private
def add_options(option_tags, options, value = nil)
if options[:include_blank]
gem 'rails', '4.0.2'
require 'active_record'
require 'logger'
# Print out what version we're running
# 4.0.2
puts "Active Record #{ActiveRecord::VERSION::STRING}"
# 4.0.1
puts "Arel #{Arel::VERSION}"