• J
    Fix XSS vulnerability in `translate` helper · 4ca2027d
    Jonathan Hefner 提交于
    Prior to this commit, when a translation key indicated that the
    translation text was HTML, the value returned by `I18n.translate` would
    always be marked as `html_safe`.  However, the value returned by
    `I18n.translate` could be an untrusted value directly from
    `options[:default]`.
    
    This commit ensures values directly from `options[:default]` are not
    marked as `html_safe`.
    4ca2027d
translation_helper.rb 6.2 KB