Skip to content

Commit 45cf1c0

Browse files
authored
Fix example in README (security) (#33)
HTML needs to be escaped. We should not suggest `html_safe`.
1 parent c0f3503 commit 45cf1c0

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -210,15 +210,15 @@ This configuration will give you some nice views, and searches to work with the
210210
params = bindings[:object].path.split("?").second
211211
if params.present?
212212
params = CGI.parse(params)
213-
"<pre>#{JSON.pretty_generate(params)}</pre>".html_safe
213+
bindings[:view].tag.pre JSON.pretty_generate(params)
214214
end
215215
end
216216
end
217217
field(:request_body) do
218-
formatted_value { "<pre>#{JSON.pretty_generate(bindings[:object].request_body)}</pre>".html_safe }
218+
formatted_value { bindings[:view].tag.pre JSON.pretty_generate(bindings[:object].request_body) }
219219
end
220220
field(:response_body) do
221-
formatted_value { "<pre>#{JSON.pretty_generate(bindings[:object].response_body)}</pre>".html_safe }
221+
formatted_value { bindings[:view].tag.pre JSON.pretty_generate(bindings[:object].response_body) }
222222
end
223223
end
224224
end

0 commit comments

Comments
 (0)