blocks|key|25259|text|问题是，您正在将输出与来自options数组的不安全字符串连接在一起。这是唯一应该使用html_safe方法以确保整个输出安全的地方：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|25260|out+<<+content_tag(:ul,++
+++content_tag(:li,+"One")+%2B+
+++content_tag(:li,+"Two")+%2B+
+++options.join('').html_safe,
:class+=>+["class_1",+"class_2"])|code-block|syntax|javascript|25261|编辑|BOLD|25262|首先，safe_join方法不像html_safe方法那样工作，它不仅使连接的字符串成为html_safe。如果连接的字符串不是html_safe，它还会使html转义，以避免有害内容。|25263|https://apidock.com/rails/ActionView/Helpers/OutputSafetyHelper/safe_join|25264|在本例中，safe_join方法根本不对out数组中的字符串做任何操作，因为它们已经被html_safe了。|25265|result+=+content_tag(:ul,++
+++++++++++content_tag(:li,+"One")+%2B+
+++++++++++content_tag(:li,+"Two")+%2B+
+++++++++++options.join(''),
+++++++++++:class+=>+["class_1",+"class_2"])

result.html_safe?+#+=>+true|25266|问题的原因是你连接了一个安全的字符串和一个不安全的字符串：|25267|content_tag(:li,+"Two")+%2B+options.join('')

content_tag(:li,+"Two").html_safe?+#+=>+true
options.join('').html_safe?++++++++#+=>+false|25268|当时options.join('')是html，因为它不安全，所以逃脱了。请参见示例：|25269|#+html+tags+in+the+second+string+are+escaped,+since+it+is+not+safe
"<li>One</li>".html_safe+%2B+"<li>Two</li>"+#+=>+"<li>One</li>&lt;li&gt;Two&lt;/li&gt;"

#+nothing+has+been+escaped,+since+everything+is+safe
"<li>One</li>".html_safe+%2B+"<li>Two</li>".html_safe+#+=>+"<li>One</li><li>Two</li>"|25270|因此，为了获得预期的结果，必须满足两个条件：|25271|25272|safe_join方法必须接受html_safe字符串数组。如果它们不是html_safe，则所有html标记都将被转义。|ordered-list-item|25273|不要将安全字符串与不安全字符串连接在一起，否则不安全字符串将被转义。|25274|25275|如您所见，您没有满足第二个条件。|25276|关于新方法的建议|25277|即使数组包含安全字符串，.join("")方法也会使结果字符串不安全。使用safe_join|25278|+++content_tag(:li,+"One")+%2B+
+++content_tag(:li,+"Two")+%2B+
+++safe_join(
+++++options.collect+do+%7Coption%7C
+++++++content_tag(:li,+option)
+++++end
+++)|25279|entityMap|0|LINK|mutability|MUTABLE|url^0|D|7|17|9|0|0|0|2|0|3|9|G|9|0|0|21|0|0|5|9|K|3|0|0|0|0|2|G|0|0|0|0|0|9|0|0|0|0|6|2|0|0|1A|C|9|11|9|0|0^^$0|@$1|2|3|4|5|6|7|1R|8|@$9|1S|A|1T|B|C]|$9|1U|A|1V|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|1W|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1X|8|@$9|1Y|A|1Z|B|M]]|D|@]|E|$]]|$1|N|3|O|5|6|7|20|8|@$9|21|A|22|B|C]|$9|23|A|24|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|6|7|25|8|@]|D|@$9|26|A|27|1|28]]|E|$]]|$1|R|3|S|5|6|7|29|8|@$9|2A|A|2B|B|C]|$9|2C|A|2D|B|C]]|D|@]|E|$]]|$1|T|3|U|5|H|7|2E|8|@]|D|@]|E|$I|J]]|$1|V|3|W|5|6|7|2F|8|@]|D|@]|E|$]]|$1|X|3|Y|5|H|7|2G|8|@]|D|@]|E|$I|J]]|$1|Z|3|10|5|6|7|2H|8|@$9|2I|A|2J|B|C]]|D|@]|E|$]]|$1|11|3|12|5|H|7|2K|8|@]|D|@]|E|$I|J]]|$1|13|3|14|5|6|7|2L|8|@]|D|@]|E|$]]|$1|15|3|-4|5|6|7|2M|8|@]|D|@]|E|$]]|$1|16|3|17|5|18|7|2N|8|@$9|2O|A|2P|B|C]]|D|@]|E|$]]|$1|19|3|1A|5|18|7|2Q|8|@]|D|@]|E|$]]|$1|1B|3|-4|5|6|7|2R|8|@]|D|@]|E|$]]|$1|1C|3|1D|5|6|7|2S|8|@]|D|@]|E|$]]|$1|1E|3|1F|5|6|7|2T|8|@$9|2U|A|2V|B|M]]|D|@]|E|$]]|$1|1G|3|1H|5|6|7|2W|8|@$9|2X|A|2Y|B|M]|$9|2Z|A|30|B|C]|$9|31|A|32|B|C]]|D|@]|E|$]]|$1|1I|3|1J|5|H|7|33|8|@]|D|@]|E|$I|J]]|$1|1K|3|-4|5|6|7|34|8|@]|D|@]|E|$]]]|1L|$1M|$5|1N|1O|1P|E|$1Q|Q]]]]

The problem is that you are concatenating your output with unsafe strings coming from <code>options</code> array. This is the only place where you should use <code>html_safe</code> method for the whole output to be safe:

<pre><code>out &lt;&lt; content_tag(:ul, 
 content_tag(:li, "One") + 
 content_tag(:li, "Two") + 
 options.join('').html_safe,
:class =&gt; ["class_1", "class_2"])
</code></pre>

Edit

First of all <code>safe_join</code> method does not work like <code>html_safe</code> method, it doesn't only make the joined strings html_safe. It also makes html escaping if the joined string are not html_safe in order to avoid harmful content.

<a href="https://apidock.com/rails/ActionView/Helpers/OutputSafetyHelper/safe_join" rel="nofollow noreferrer">https://apidock.com/rails/ActionView/Helpers/OutputSafetyHelper/safe_join</a>

In your case <code>safe_join</code> method didn't do anything at all with the strings in <code>out</code> array, since they had already been html_safe. 

<pre><code>result = content_tag(:ul, 
 content_tag(:li, "One") + 
 content_tag(:li, "Two") + 
 options.join(''),
 :class =&gt; ["class_1", "class_2"])

result.html_safe? # =&gt; true
</code></pre>

The cause of the problem is that you concatenated a safe string with unsafe one:

<pre><code>content_tag(:li, "Two") + options.join('')

content_tag(:li, "Two").html_safe? # =&gt; true
options.join('').html_safe? # =&gt; false
</code></pre>

At that moment <code>options.join('')</code> was html escaped since it wasn't safe. See the example:

<pre><code># html tags in the second string are escaped, since it is not safe
"&lt;li&gt;One&lt;/li&gt;".html_safe + "&lt;li&gt;Two&lt;/li&gt;" # =&gt; "&lt;li&gt;One&lt;/li&gt;&amp;lt;li&amp;gt;Two&amp;lt;/li&amp;gt;"

# nothing has been escaped, since everything is safe
"&lt;li&gt;One&lt;/li&gt;".html_safe + "&lt;li&gt;Two&lt;/li&gt;".html_safe # =&gt; "&lt;li&gt;One&lt;/li&gt;&lt;li&gt;Two&lt;/li&gt;"
</code></pre>

So, in order to get expected results 2 conditions must be met:

<ol>
<li><code>safe_join</code> method must take array of html_safe strings. If they are not html_safe, all html tags will be escaped. </li>
<li>Do not concatenate a safe string with an unsafe one, otherwise the unsafe string will be escaped.</li>
</ol>

As you can see, you did not fulfill the second condition.

Suggestions about the new approach

<code>.join("")</code> method makes the result string unsafe, even if the array contains safe strings. Use <code>safe_join</code>:

<pre><code> content_tag(:li, "One") + 
 content_tag(:li, "Two") + 
 safe_join(
 options.collect do |option|
 content_tag(:li, option)
 end
 )
</code></pre>

I am building a block of HTML code using Rails' <code>content_tag</code> helper. The challenge I face right now is joining HTML strings from an array with HTML elements generated by <code>content_tag</code>.

RuboCop <a href="http://rubocop.readthedocs.io/en/latest/cops_rails/#railsoutputsafety" rel="nofollow noreferrer">Rails/OutputSafety</a> reference.

For example:

<pre><code>options = ["&lt;li&gt;Three&lt;/li&gt;", "&lt;li&gt;Four&lt;/li&gt;", "&lt;li&gt;Five&lt;/li&gt;"]

# This is code to generate blocks of HTML
out = []
out &lt;&lt; content_tag(:ul, 
 content_tag(:li, "One") + 
 content_tag(:li, "Two") + 
 options.join(''),
:class =&gt; ["class_1", "class_2"])
safe_join(out)

# Expect result should be like
&lt;ul class="class_1 class_2"&gt;
 &lt;li&gt;One&lt;/li&gt;
 &lt;li&gt;Two&lt;/li&gt;
 &lt;li&gt;Three&lt;/li&gt;
 &lt;li&gt;Four&lt;/li&gt;
 &lt;li&gt;Five&lt;/li&gt;
&lt;/ul&gt;

# Actual result
&lt;ul class="class_1 class_2"&gt;
 &lt;li&gt;One&lt;/li&gt;
 &lt;li&gt;Two&lt;/li&gt;
 "&lt;li&gt;Three&lt;/li&gt;&lt;li&gt;Four&lt;/li&gt;&lt;li&gt;Five&lt;/li&gt;"
&lt;/ul&gt;
</code></pre>

However, if I use the html_safe approach like below, it will work.

<pre><code>%{&lt;ul&gt;
 &lt;li&gt;One&lt;/li&gt;
 &lt;li&gt;Two&lt;/li&gt;
 #{options.join('')}
 &lt;/ul&gt;
}.html_safe
</code></pre>

Any suggestions on what I should change?

<pre><code># New apporach
options = ["Three", "Four", "Five"]
out = []
out &lt;&lt; content_tag(:ul, 
 content_tag(:li, "One") + 
 content_tag(:li, "Two") + 
 options.collect do |option|
 content_tag(:li, "#{option[0]}")
 end.join(""),
:class =&gt; ["class_1", "class_2"])
safe_join(out)

# New approach result
&lt;ul class="class_1 class_2"&gt;
 &lt;li&gt;One&lt;/li&gt;
 &lt;li&gt;Two&lt;/li&gt;
 "&lt;li&gt;Three&lt;/li&gt;&lt;li&gt;Four&lt;/li&gt;&lt;li&gt;Five&lt;/li&gt;"
&lt;/ul&gt;
</code></pre>

safe_join and content_tag approach to replace html_safe

我正在使用Rails的content_tag助手构建一段HTML代码。我现在面临的挑战是将数组中的HTML字符串与content_tag生成的HTML元素连接起来。RuboCop 参考。例如：options = ["<li>Three</li>", "<li>Four</li>", "<li>Five</li>"]# ...

问替代html_safe的safe_join和content_tag方法
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问替代html_safe的safe_join和content_tag方法EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问替代html_safe的safe_join和content_tag方法
EN