Rails: array.join with html in separator is escaped

Question

I have an array of Strings containing unsave content (user input).

I want to join these Strings in my template, separated by <br />.

I tried:

somearray.join("<br />")

But this will also escape the sparator.

Is there a workaround, keeping in mind that the content of the array absolutely must be escaped?

Yes should be as parts of the string are not safe. Then the whole string is considered as unsafe. — iltempo, Mar 06 '12 at 12:59
Found the following workaround: `simple_format(somearray.join("\r\n"))`, but I think there must be a better solution — Majiy, Mar 06 '12 at 13:00
Another workaround: `h(somearray.join("\r\n")).gsub("\r\n","
")` — Majiy, Mar 06 '12 at 13:03

score 4 · Answer 1 · answered Nov 03 '14 at 21:28

4

raw and h provide ways to apply this default behavior selectively.

<%= raw user_values_array.map {|user_value| h user_value }.join('<br />') %>

Better still, Rails 3.1 introduced safe_join(array, sep) for this purpose. Used with html_safe it can do what you need.

<%= safe_join(user_values_array, "<br />".html_safe) %>

Documentation

answered Nov 03 '14 at 21:28

rep

1,546
1
12
19

1

Also you can use the `tag` helper, like this: `safe_join(somearray.split('\\n'), tag(:br))` – amoebe Oct 30 '17 at 13:52

score 3 · Accepted Answer · answered Mar 06 '12 at 13:08

3

Is there a reason it has to be a <br /> tag? Could you use a list instead?

<ul>
  <% somearray.each do |item| %>
    <%= content_tag :li, item %>
  <% end %>
</ul>

answered Mar 06 '12 at 13:08

Peter Brown

50,956
18
113
146

Not exactly what I was looking for, but it will do for my purpose. Thanks. – Majiy Mar 06 '12 at 14:22

score 2 · Answer 3 · answered Mar 06 '12 at 13:17

2

Have you tried this?

raw somearray.join("<br />")

answered Mar 06 '12 at 13:17

cicloon

1,099
5
13

3

Note that this will trust the array elements as well. – iltempo Mar 06 '12 at 13:31

score 0 · Answer 4 · answered Feb 01 '23 at 10:58

0

Nowadays, the state-of-the-art way to solve this is:

# Inside a view:
safe_join(somearray, '<br />')

# From somewhere else, given the current controller:
controller.helpers.safe_join(somearray, '<br />')

answered Feb 01 '23 at 10:58

Kalsan

822
1
8
19

Rails: array.join with html in separator is escaped

4 Answers4