Untitled

lib/semantic_menu.rb

@@ -15,22 +15,22 @@ def initialize(title, link, level, link_opts={})
   end
 
   def add(title, link, link_opts={}, &block)
-    returning(MenuItem.new(title, link, @level +1, link_opts)) do |adding|
+    MenuItem.new(title, link, @level +1, link_opts).tap do |adding|
       @children << adding
       yield adding if block_given?
     end
   end
 
   def to_s
-    content_tag :li, link_to(@title, @link, @link_opts) + child_output, ({:class => 'active'} if active?)
+    content_tag :li, SemanticMenu::Util.html_safe(link_to(@title, @link, @link_opts) + child_output), ({:class => 'active'} if active?)
   end
 
   def level_class
     "menu_level_#{@level}"
   end
 
   def child_output
-    children.empty? ? '' : content_tag(:ul, @children.collect(&:to_s).join, :class => level_class)
+    children.empty? ? '' : content_tag(:ul, SemanticMenu::Util.html_safe(@children.collect(&:to_s).join), :class => level_class)
   end
 
   def active?
@@ -44,6 +44,29 @@ def on_current_page?
 end
 
 class SemanticMenu < MenuItem
+  # Adapted from Formtastic::Util, which was in turn
+  # Adapted from the rails3 compatibility shim in Haml 2.2
+  module Util
+    extend self
+    ## Rails XSS Safety
+
+    # Returns the given text, marked as being HTML-safe.
+    # With older versions of the Rails XSS-safety mechanism,
+    # this destructively modifies the HTML-safety of `text`.
+    #
+    # @param text [String]
+    # @return [String] `text`, marked as HTML-safe
+    def html_safe(text)
+      return text if text.nil?
+      return text.html_safe if defined?(ActiveSupport::SafeBuffer)
+      return text.html_safe!
+    end
+
+    def rails_safe_buffer_class
+      return ActionView::SafeBuffer if defined?(ActionView::SafeBuffer)
+      ActiveSupport::SafeBuffer
+    end
+  end
 
   def initialize(controller, opts={},&block)
    @@controller = controller
@@ -55,6 +78,6 @@ def initialize(controller, opts={},&block)
   end
 
   def to_s
-    content_tag(:ul, @children.collect(&:to_s).join, @opts)
+    content_tag(:ul, SemanticMenu::Util.html_safe(@children.collect(&:to_s).join), @opts)
   end
 end