Escape feed content with Builder rather than by hand

Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.

Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.

config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.

1 files changed, 0 insertions, 19 deletions

diff --git a/config/initializers/xmlparser.rb b/config/initializers/xmlparser.rb
deleted file mode 100644
index 1d5e06d9..00000000
--- a/config/initializers/xmlparser.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-class XML::Node
-  def replace_with(other)
-    self.next = other
-    remove!
-  end
-end
-
-# Builder 3.x escapes content by default. Override _escape to pass text
-# through raw, preserving existing behaviour from the Rails 2 era.
-# Note: require builder first to ensure XmlBase < BasicObject is already
-# defined before we reopen it.
-require 'builder'
-module Builder
-  class XmlBase
-    def _escape(text)
-      text
-    end
-  end
-end