From 5690cf4d4e05eafdfd2e270bbdf1a925114d0f76 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sun, 9 Aug 2026 23:31:35 +0200 Subject: Escape feed content with Builder rather than by hand Builder escapes by default; the three feed templates no longer call CGI.escapeHTML. This fixes two sites that never escaped at all: the tag feed's externally supplied :tag segment, interpolated into its title, self link and id, and dc:creator in the RDF template. Subscribers see one difference: quotes and apostrophes arrive raw, which is valid in element text. config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape as the identity function, is gone. XML::Node#replace_with went with it, no callers. --- config/initializers/xmlparser.rb | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 config/initializers/xmlparser.rb (limited to 'config') diff --git a/config/initializers/xmlparser.rb b/config/initializers/xmlparser.rb deleted file mode 100644 index 1d5e06d9..00000000 --- a/config/initializers/xmlparser.rb +++ /dev/null @@ -1,19 +0,0 @@ -class XML::Node - def replace_with(other) - self.next = other - remove! - end -end - -# Builder 3.x escapes content by default. Override _escape to pass text -# through raw, preserving existing behaviour from the Rails 2 era. -# Note: require builder first to ensure XmlBase < BasicObject is already -# defined before we reopen it. -require 'builder' -module Builder - class XmlBase - def _escape(text) - text - end - end -end -- cgit v1.3