Question

I am using Rails 3.2.x and I have following code in view.

<%= order.address.address_array.join('<br />').html_safe %>

address is an array of address1, address2, city name, state name, country name and zip code – standard stuff.

Since I am marking the content as html_safe if user enters <script>something</script. in city name then that javascript code will be executed.

What is a clean way to show address with line break without exposing security issue.

Answer 1

You have to call html_safe on each lines of your address array before joining. It should looks like that (not tested):

<%= order.address.address_array.map(&:html_escape).join('<br />') %>