Why was auto_link deprecated in Rails?

Question

I realize it's been pulled into a separate gem, but what's the reason? Is this just a matter of streamlining Rails, or is there some reason I should be weary of auto_link?

(The gem says it's meant to 'bridge the gap for people migrating', which suggests to me that if I'm introducing rails_autolink into a new project, I must be doing something wrong, no?)

thanks,

Chino

Because it's not good practice to use auto_link for most applications. While some uses of auto_link may be spot on, most uses of it in most applications are not, and should be done another way. – Aesculapian

At the risk of appearing obtuse, I must ask: why is it bad practice? Is it a safety issue or something? better to detect links manually for some reason? In my case I want user submitted comments to include live links, so it'd make life easier. Thanks – Chino

If you think it is appropriate for your application in particular, because of the particular details of your application, then by all means. That specific part of your particular application sounds like one such special case where it would be appropriate to use auto_link. The overall point is that only some applications should be using it, not most. Rails should only have the things that most applications do use, should use, or could use, but since auto_link is not one of those things, it got removed from Rails. – Aesculapian

Answer 1

From the commit where auto_link was removed, Aaron Patterson (tenderlove) explains in the comments:

Unfortunately this method is extremely difficult to secure correctly. Ensuring this method is bullet-proof takes a faster release cycle than we have for rails. That's why we moved it to a gem. Please use the gem if you need the functionality! :-)

https://github.com/rails/rails/commit/81cfbf4146d3c5a58054b64112b8ce196f2fc061

Each security fix only requires updating one gem, instead of the 6 for rails.

Cateyed