From 5690cf4d4e05eafdfd2e270bbdf1a925114d0f76 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sun, 9 Aug 2026 23:31:35 +0200 Subject: Escape feed content with Builder rather than by hand Builder escapes by default; the three feed templates no longer call CGI.escapeHTML. This fixes two sites that never escaped at all: the tag feed's externally supplied :tag segment, interpolated into its title, self link and id, and dc:creator in the RDF template. Subscribers see one difference: quotes and apostrophes arrive raw, which is valid in element text. config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape as the identity function, is gone. XML::Node#replace_with went with it, no callers. --- test/controllers/rss_controller_test.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'test/controllers/rss_controller_test.rb') diff --git a/test/controllers/rss_controller_test.rb b/test/controllers/rss_controller_test.rb index 00224119..4393c5fc 100644 --- a/test/controllers/rss_controller_test.rb +++ b/test/controllers/rss_controller_test.rb @@ -41,4 +41,19 @@ class RssControllerTest < ActionController::TestCase assert_includes @response.body, "feed-inside" assert_not_includes @response.body, "feed-outside" end + + test "the feed escapes markup characters in a title" do + updates = Node.root.children.find_by(:slug => "updates") + node = updates.children.create!(:slug => "feed-escaping") + node.reload.draft.update!(:title => %{Fnord & bold "quoted"}, + :tag_list => "update") + node.publish_draft! + + get :updates, params: { :format => :xml } + + assert_response :success + assert_includes @response.body, "Fnord & <b>bold</b>" + assert_not_includes @response.body, "bold" + assert_not_includes @response.body, "&amp;" + end end -- cgit v1.3