So why would a currency formatter generate HTML instead of plain text? That seems very strange to me. How does the helper know if I want to use the number in HTML, an email header or even a shell argument? Or are RoR helpers designed to be only usable directly with HTML?
PHP's number_format() doesn't escape for HTML - is that an XSS bug too?
Comments
So why would a currency formatter generate HTML instead of plain text? That seems very strange to me. How does the helper know if I want to use the number in HTML, an email header or even a shell argument? Or are RoR helpers designed to be only usable directly with HTML?
PHP's number_format() doesn't escape for HTML - is that an XSS bug too?
The view-dependent stuff is in fact separated from the business conversion logic and can be used in a non-web context if you want.
Here's the version for use in a view context: https://github.com/rails/rails/blob/master/actionview/lib/ac...
You can see that this method has some XSS prevention logic.
Here's the converter itself: https://github.com/rails/rails/blob/master/activesupport/lib...