Unescaping javascript in rails.rb file / js return in ruby ​​methods

Question

I have the following js (in a string literal) returned in one of my plugin methods. Therefore, when I call a method, this puts it in my opinion. The problem is on the website, everything <, ", ', >, etc. Shielded in <, "and something else. How can i do this? I tried different methods, but none of them work: / I think this plugin may be old, so this was possible in earlier versions of Rails ...

%Q{<script type="text/javascript">
    $(function() {
        $('#{table_dom_id}').dataTable({
          "oLanguage": {
            "sSearch": "#{search_label}",
            #{"'sZeroRecords': '#{no_records_message}'," if no_records_message}
            "sProcessing": '#{processing}'
          },
          "sPaginationType": "full_numbers",
          "iDisplayLength": #{per_page},
          "bProcessing": true,
          "bServerSide": #{server_side},
          "bLengthChange": false,
          "bStateSave": #{persist_state},
          "bFilter": #{search},
          "bAutoWidth": #{auto_width},
          #{"'aaSorting': [#{sort_by}]," if sort_by}
          #{"'sAjaxSource': '#{ajax_source}'," if ajax_source}
          "aoColumns": [
                #{formatted_columns(columns)}
                    ],
            #{"'fnRowCallback': function( nRow, aData, iDisplayIndex ) { #{row_callback} }," if row_callback}
          "fnServerData": function ( sSource, aoData, fnCallback ) {
            aoData.push( #{additional_data_string} );
            $.getJSON( sSource, aoData, function (json) {
                    fnCallback(json);
                } );
          }
        })#{append};
    });
    </script>}

Any help is appreciated, thanks!

Answer 1

This is set quite often. You must tell Rails not to escape the line in one of two ways:

• <%= 'string'.html_safe %>
• <%= raw 'string' %>

, . , , HTML-Safe, , , - , . , .

, - . . ( ).

Answer 2

Rails html, XSS. :

# Provided that my_escaped_string is what you want to display
<%= my_escaped_string.html_safe %>
<%= raw my_escaped_string %>

html_safe .