StringLike field with quotes breaks out of title

[DRSisco]

Describe the bug

Storing content in a field that contains quotes results in only the content before the first quote is in the title. The rest of the content is stored in the tag as individual attributes.

We noticed this when the word hidden was stored after a quote, which resulted in the cell being hidden and the rest of the row shifting to the left.

Reproduction steps

• For a given record with a StringLike field:
  • Put the content Example "text" hidden in the field.
  • View the index page that contains this model/field.

Expected behavior

• The content should show (with ellipsis if necessary based on space), and the title should represent the whole field escaping quotes with "

Additional context

• rails version: 7.1.3
• rails_admin version: 3.0.0.beta2

[mshibuya]

I realized that this issue lead to an XSS vulnerability, so I've published a security advisory: GHSA-8qgm-g2vv-vwvc
I recommend upgrading to the latest release 3.1.3, as soon as possible. Also fixed in the master: 32f91e4

Thank you for giving the valuable report 👍

[q3aiml]

@mshibuya thank you for your work on this!

When trying 3.1.3 with this change I am seeing unescaped HTML tags in the title attribute. The field value does appear properly escaped -- it is the HTML from pretty_value in rails admin that is unescaped and no longer stripped out.

For example on booleans:

<td class="flag1_field boolean_type" title="<span class="badge bg-danger"><span class="fas fa-times"></span></span>">
  <span class="badge bg-danger"><span class="fas fa-times"></span></span>
</td>

Or associations:

<td class="user_field belongs_to_association_type" title="<a href="/admin/user/00000000-0000-0000-0000-000000000000">Test User1</a>">
  <a href="/admin/user/00000000-0000-0000-0000-000000000000">Test User1</a>
</td>

• rails version: 7.0.8.4
• rails_admin version: 3.1.3

[mshibuya]

@q3aiml So sorry for the issue, I messed up 🙇‍♂️
I'm preparing for another release now.

[mshibuya]

Released 3.1.4. Please give it a try, and if you see any issue please let me know 🙇‍♂️