Escape feed content with Builder rather than by hand

Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.

Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.

config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.

1 files changed, 3 insertions, 3 deletions

diff --git a/app/views/rss/updates.xml.builder b/app/views/rss/updates.xml.builder
index a2c277d6..f09d6a74 100644
--- a/app/views/rss/updates.xml.builder
+++ b/app/views/rss/updates.xml.builder
@@ -12,7 +12,7 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
   
   @items.each do |item|
     xml.entry do
-      xml.title(CGI.escapeHTML(item.title.to_s))
+      xml.title(item.title.to_s)
       xml.link(
         :href => content_url(:page_path => item.node.unique_path),
         :rel  => "alternate",
@@ -21,8 +21,8 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
       xml.id(content_url(:page_path => item.node.feed_id))
       xml.updated(item.updated_at.xmlschema)
       xml.published(item.published_at.xmlschema)
-      xml.summary(CGI.escapeHTML(item.abstract.to_s))
-      xml.content(CGI.escapeHTML(item.body.to_s), :type => "html")
+      xml.summary(item.abstract.to_s)
+      xml.content(item.body.to_s, :type => "html")
     end
     
   end