fixed escaping bug in select_field helper

mojolicious · Mar 10, 2012 · 012ccd8 · 012ccd8
1 parent 02a4afc
commit 012ccd8
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 7 deletions.
diff --git a/Changes b/Changes
@@ -2,7 +2,7 @@ This file documents the revision history for Perl extension Mojolicious.
 
 2.60    2012-03-10 00:00:00
         - Made text_area helper a little smarter. (sshaw, sri)
-        - Fixed escaping bug in text_area helper.
+        - Fixed escaping bug in select_field and text_area helpers.
 
 2.59    2012-03-09 00:00:00
         - Removed duplicate 2.58 directory.

diff --git a/lib/Mojolicious/Plugin/TagHelpers.pm b/lib/Mojolicious/Plugin/TagHelpers.pm
@@ -144,7 +144,7 @@ sub register {
         %attrs = (%attrs, @$pair[2 .. $#$pair]);
 
         # Option tag
-        $self->_tag('option', %attrs, sub { $pair->[0] });
+        $self->_tag('option', %attrs, sub { xml_escape $pair->[0] });
       };
 
       return $self->_tag(

diff --git a/t/mojolicious/tag_helper_lite_app.t b/t/mojolicious/tag_helper_lite_app.t
@@ -234,7 +234,7 @@ $t->put_ok('/selection')->status_is(200)
     . '<select name="a">'
     . '<option value="b">b</option>'
     . '<optgroup label="c">'
-    . '<option value="d">d</option>'
+    . '<option value="&lt;d">&lt;d</option>'
     . '<option value="e">E</option>'
     . '<option value="f">f</option>'
     . '</optgroup>'
@@ -258,7 +258,7 @@ $t->put_ok('/selection?a=e&foo=bar&bar=baz')->status_is(200)
     . '<select name="a">'
     . '<option value="b">b</option>'
     . '<optgroup label="c">'
-    . '<option value="d">d</option>'
+    . '<option value="&lt;d">&lt;d</option>'
     . '<option selected="selected" value="e">E</option>'
     . '<option value="f">f</option>'
     . '</optgroup>'
@@ -282,7 +282,7 @@ $t->put_ok('/selection?foo=bar&a=e&foo=baz&bar=d')->status_is(200)
     . '<select name="a">'
     . '<option value="b">b</option>'
     . '<optgroup label="c">'
-    . '<option value="d">d</option>'
+    . '<option value="&lt;d">&lt;d</option>'
     . '<option selected="selected" value="e">E</option>'
     . '<option value="f">f</option>'
     . '</optgroup>'
@@ -306,7 +306,7 @@ $t->put_ok('/selection?preselect=1')->status_is(200)
     . '<select name="a">'
     . '<option selected="selected" value="b">b</option>'
     . '<optgroup label="c">'
-    . '<option value="d">d</option>'
+    . '<option value="&lt;d">&lt;d</option>'
     . '<option value="e">E</option>'
     . '<option value="f">f</option>'
     . '</optgroup>'
@@ -440,7 +440,7 @@ __DATA__
 @@ selection.html.ep
 % param a => qw/b g/ if param 'preselect';
 %= form_for selection => begin
-  %= select_field a => ['b', {c => ['d', [ E => 'e'], 'f']}, 'g']
+  %= select_field a => ['b', {c => ['<d', [ E => 'e'], 'f']}, 'g']
   %= select_field foo => [qw/bar baz/], multiple => 'multiple'
   %= select_field bar => [['D' => 'd', disabled => 'disabled'], 'baz']
   %= submit_button