Safely Passing Ruby Variables to JavaScript in ERB

from blog code.dblock.org | tech blog, | ↗ original
A user reported a bug in Slava, a bot that syncs Strava activities to Slack, where they couldn’t subscribe to the paid version because their Slack team name contained a quote. That was a rookie mistake on my part in HTML escaping that almost cost me $9.99. Interestingly, it required a rather non-trivial fix. The bot’s code extensively uses ERB,...