Code climate is warning us about a potential cross site scripting issue. Is escapeHTML not sufficient here?

link_to(t(".button_text"), main_app.some_path(:id => (h(params[:id]))), :class => "btn")
有帮助吗?

解决方案

What about using an object fetched from the controller and passing it to the path helper?

def index
  @some_object = SomeObject.find(params[:id])
  [...]
end

and then in your view use this object to build the route ?

link_to(t(".button_text"), main_app.some_path(@some_object), :class => "btn")
许可以下: CC-BY-SA归因
不隶属于 StackOverflow
scroll top