content_tag HTML attributes beginning with @ are escaped to _

[Lordnibbler]

Steps to reproduce

# rails 7.0.2.4
content_tag(:div, "test", "@click": "triggerNav()")
# => "<div _click=\"triggerNav()\">test</div>"

# rails <=7.0.2.3
content_tag(:div, "test", "@click": "triggerNav()")
# => "<div @click=\"triggerNav()\">test</div>"

Expected behavior

content_tag should output HTML attributes beginning with @ symbol into the HTML.

Actual behavior

CVE 27777 caused a change in behavior in content_tag and related HTML helper functions. Providing HTML attributes which begin with a @ symbol (as used in alpine.js and other libraries) now are escaped to _, rendering these helper functions unusable.

649516c
https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534

System configuration

Rails version: 7.0.2.4
Ruby version: 3.1.0

[KostasKostogloy]

@Lordnibbler I just faced the same issue (also using alpinejs). Fortunately alpinejs @click is an alias of x-on:click, you can replace its usage till this is resolved.

[eileencodes]

I fixed this in #45027 and backported it to all the versions of Rails. I'll do a release tomorrow or early next week.

[eileencodes]

Closing as the release went out this morning. Hope that fixes the issue for you!

[rylanb]

Note for anyone following along behind me:
https://vuejs.org/guide/components/slots.html#named-slots

v-slot:default can be short-handed to #default. I'm seeing that render out as _default instead of #default in this 6.0.5 update.

Fix is to change to long-hand version for now.