From: Austin Ziegler <halostatue@...>
Date: 2004-08-23T02:27:04+09:00
Subject: Re: 1.8.1 gsub/CGI behavior I can't explain

On Mon, 23 Aug 2004 00:59:15 +0900, David A. Black <dblack@wobblini.net> wrote:
> I have no explanation for this, but here it is.
> 
> I have a gsub! call in a CGI script (part of RCRchive).  It has a
> block, and the purpose is to filter out unacceptable tags from
> user input:
> 

David, can you try this instead?

TAG = %r{<((?:\s*/?\s*)(\w+)(?:\s+[^>]+)?)>}

@text.gsub!(TAG) do
  caps = Regexp.last_match.captures
  if GOOD.include?(caps[1].downcase.strip)
    "<#{caps[0]}>"
  else
    "&lt;#{caps[0]}&gt;"
  end
end

If you prefer not to do Regexp.last_match, you can use:

@text.gsub!(TAG) do
  if GOOD.include?($2.downcase.strip)
    "<#{$1}>"
  else
    "&lt;#{$1}&gt;"
  end
end

This simplifies your regular expression at the cost of having to
replace the <> on good tags.

-austin
-- 
Austin Ziegler * halostatue@gmail.com
               * Alternate: austin@halostatue.ca