# XSS and partials in Rails 2.3.7

**URL:** <https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122>\
**Category:** Rails\
**Created:** [May 25, 2010, 2:39am UTC](https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122 "2010-05-25T02:39:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58956e/32.png) [@dee](https://www.ruby-forum.com/u/dee)\
**Post date:** [May 25, 2010, 2:39am UTC](https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122/1 "2010-05-25T02:39:54Z")

</div>

Hey all,

Just wondering if there is any reason that the new XSS safety code in  
2.3.7 is escaping my partials. That don’t seem right!

I’ve overcome it temporarily by throwing in a “raw” like this:  
\<%= render raw :partial =\> ‘mypartial’ %\>

It’s also escaping any inline tags in the templates. (This  
may be by design, I dunno.)

In advance of some responses that might come from this question, I’ve  
already read the update I’ve copied below and don’t think it applies  
here since I installed the rails\_xss plugin.

TIA,  
Dee

“Update: fixing compatibility with the rails\_xss plugin broke HTML-  
safety for apps that don’t use rails\_xss. We’re sorry, all: HTML-  
safety is meant to be opt-in! The fix is available now in 2.3.8.pre1  
and will be released shortly.”

---

<div class="post-metadata">

**Author:** ![dee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58956e/32.png) [@dee](https://www.ruby-forum.com/u/dee)\
**Post date:** [May 25, 2010, 2:53am UTC](https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122/2 "2010-05-25T02:53:57Z")

</div>

Sorry, I had a little typo in my code. That should read:  
\<%= raw render :partial =\> ‘mypartial’ %\>

(Note the order in which raw is called.)

---

<div class="post-metadata">

**Author:** ![dee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58956e/32.png) [@dee](https://www.ruby-forum.com/u/dee)\
**Post date:** [May 25, 2010, 5:52am UTC](https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122/3 "2010-05-25T05:52:29Z")

</div>

On Mon, May 24, 2010 at 5:38 PM, Dee [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Just wondering if there is any reason that the new XSS safety code in  
> 2.3.7 is escaping my partials. That don’t seem right!

Definitely not right! Are you using the latest rails\_xss plugin from  
[GitHub - rails/rails\_xss: A plugin for rails 2.3 apps which switches the default to escape by default](http://github.com/rails/rails_xss) ?

jeremy

---

<div class="post-metadata">

**Author:** ![dee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58956e/32.png) [@dee](https://www.ruby-forum.com/u/dee)\
**Post date:** [May 25, 2010, 12:33pm UTC](https://www.ruby-forum.com/t/xss-and-partials-in-rails-2-3-7/189122/4 "2010-05-25T12:33:28Z")

</div>

Yes,. I installed it yesterday after 2.3.7 because it was recommended.  
I have since upgraded to 2.3.8.pre1 (which still reports it is 2.3.7  
btw) and get similar results as before.

I have since noticed it not all of the partials that are getting  
escaped, just the ones being called inside a content\_for block. Easy  
repro. That might be the key, eh? It still doesn’t seem right.