# Overwrites helper methods in Action Pack to give them Rails XSS powers. These powers are there by default in Rails 3.
module RailsXssHelper
  def link_to(*args, &block)
    if block_given?
      options      = args.first || {}
      html_options = args.second
      concat(link_to(capture(&block), options, html_options))
    else
      name         = args.first
      options      = args.second || {}
      html_options = args.third

      url = url_for(options)

      if html_options
        html_options = html_options.stringify_keys
        href = html_options['href']
        convert_options_to_javascript!(html_options, url)
        tag_options = tag_options(html_options)
      else
        tag_options = nil
      end

      href_attr = "href=\"#{url}\"" unless href
      "<a #{href_attr}#{tag_options}>#{ERB::Util.h(name || url)}</a>".html_safe
    end
  end
end

ActionController::Base.helper(RailsXssHelper)

module ActionView
  module Helpers
    module TagHelper
      private
        def content_tag_string_with_escaping(name, content, options, escape = true)
          content_tag_string_without_escaping(name, ERB::Util.h(content), options, escape)
        end
        alias_method_chain :content_tag_string, :escaping
    end
  end
end

# Overwrites helper methods in Action Pack to give them Rails XSS powers. These powers are there by default in Rails 3.
module RailsXssHelper
  def link_to(*args, &block)
    if block_given?
      options      = args.first || {}
      html_options = args.second
      concat(link_to(capture(&block), options, html_options))
    else
      name         = args.first
      options      = args.second || {}
      html_options = args.third

      url = url_for(options)

      if html_options
        html_options = html_options.stringify_keys
        href = html_options['href']
        convert_options_to_javascript!(html_options, url)
        tag_options = tag_options(html_options)
      else
        tag_options = nil
      end

      href_attr = "href=\"#{url}\"" unless href
      "<a #{href_attr}#{tag_options}>#{ERB::Util.h(name || url)}</a>".html_safe
    end
  end
end

ActionController::Base.helper(RailsXssHelper)

module ActionView
  module Helpers
    module TextHelper
      def concat(string, unused_binding = nil)
        if unused_binding
          ActiveSupport::Deprecation.warn("The binding argument of #concat is no longer needed.  Please remove it from your views and helpers.", caller)
        end

        output_buffer.concat(string)
      end
    end
    module TagHelper
      private
        def content_tag_string_with_escaping(name, content, options, escape = true)
          content_tag_string_without_escaping(name, ERB::Util.h(content), options, escape)
        end
        alias_method_chain :content_tag_string, :escaping
    end
  end
end

Revert "Revert "concat should check the input if escape or not using SafeBuffer concat method""
Revert "Revert "concat should check the input if escape or not using SafeBuffer concat method""

This reverts commit 4cee99a3b69cd51d28f4d32e28af851f59724e5f.

Signed-off-by: Jeremy Kemper <b3f594e10a9edcf5413cf1190121d45078c62290@bitsweat.net>
