Escape feed content with Builder rather than by hand

Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.

Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.

config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.

1 files changed, 15 insertions, 0 deletions

diff --git a/test/controllers/rss_controller_test.rb b/test/controllers/rss_controller_test.rb
index 00224119..4393c5fc 100644
--- a/test/controllers/rss_controller_test.rb
+++ b/test/controllers/rss_controller_test.rb
@@ -41,4 +41,19 @@ class RssControllerTest < ActionController::TestCase
     assert_includes     @response.body, "feed-inside"
     assert_not_includes @response.body, "feed-outside"
   end
+
+  test "the feed escapes markup characters in a title" do
+    updates = Node.root.children.find_by(:slug => "updates")
+    node    = updates.children.create!(:slug => "feed-escaping")
+    node.reload.draft.update!(:title => %{Fnord & <b>bold</b> "quoted"},
+                              :tag_list => "update")
+    node.publish_draft!
+
+    get :updates, params: { :format => :xml }
+
+    assert_response :success
+    assert_includes     @response.body, "Fnord &amp; &lt;b&gt;bold&lt;/b&gt;"
+    assert_not_includes @response.body, "<b>bold</b>"
+    assert_not_includes @response.body, "&amp;amp;"
+  end
 end