Question

Code climate is warning us about a potential cross site scripting issue. Is escapeHTML not sufficient here?

link_to(t(".button_text"), main_app.some_path(:id => (h(params[:id]))), :class => "btn")
Was it helpful?

Solution

What about using an object fetched from the controller and passing it to the path helper?

def index
  @some_object = SomeObject.find(params[:id])
  [...]
end

and then in your view use this object to build the route ?

link_to(t(".button_text"), main_app.some_path(@some_object), :class => "btn")
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top