Missing escape of labels about google_visualr HOT 4 CLOSED

You should use render_chart helper method instead of calling to_js directly, i.e.

render_chart(chart, 'div_id')

The render_chart helper performs the proper html escaping before returning.

from google_visualr.

@jacobat is right. I didn't escape the labels:

@cols.each do |column|
    js << "data_table.addColumn("
    if column[:role].nil?
      js << column.map{ |key, value| "'#{value}'" }.join(", ")
    else
      js << "{" + column.map{ |key, value| "#{key}: '#{value}'" }.join(", ") + "}"
    end
    js << ");"
end

from google_visualr.

Would it be possible to construct the JS strings with to_json instead?

Say:

      @cols.each do |column|
        js << "data_table.addColumn("
        js << column.to_json
        js << ");"
      end

from google_visualr.

Fixed. Thank you!

from google_visualr.