Strip_tags regression in Rails 4.2.4

[tjchambers]

Rails 4.2.1

2.2.0 :001 > include ActionView::Helpers::SanitizeHelper
 => Object
2.2.0 :002 > strip_tags('&lt;<title>&gt;')
 => "&lt;&gt;"

Rails 4.2.4

2.2.0 :004 > include ActionView::Helpers::SanitizeHelper
 => Object
2.2.0 :006 > strip_tags('&lt;<title>&gt;')
 => "<>"

Therefore strip_tags is NOW in Rails 4.2.4 also translating text as well as stripping out tags. The lt; and gt; are TEXT and should be left alone.

[tjchambers]

I have not been able to find anything in the change log regarding this FUNCTIONAL change. Why was it not noted?

[tjchambers]

From the 4.2.4 documentation on sanitization:

Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid or even well-formed. For example, the output may still contain unescaped characters like <, >, or &.

Note the reference to &

[tjchambers]

Apologies for posting twice. I inferred I had posted this issue in an incorrect location based on no acknowledging response.

[rafaelfranca]

No problem. I already have a potential fix for this issue but it doesn't work in all the cases. I'll keep you updated.

[tjchambers]

Let me know if I can assist in any way. I have worked around the issue for now.

[ivdma]

Any updates on this issue? Our application depends on it heavily so this issue prevents us from upgrading to Rails 4.2.4.

[aianus]

@rafaelfranca

Is a fix still incoming or shall I take a crack at it? This bug makes this gem practically useless.

[kaspth]

@aianus do dig in, please 😄

[rafaelfranca]

That is fixed now.