[ruby-core:47152] Re: [ruby-trunk - Bug #6861] ERB::Util.escape_html is not escaping single quotes

On Mon, Aug 13, 2012 at 01:11:45PM +0900, shugo (Shugo Maeda) wrote:
> 
> Issue #6861 has been updated by shugo (Shugo Maeda).
> 
> Assignee set to shugo (Shugo Maeda)
> 
> Hello,
> 
> Thanks for your report.
> 
> spastorino (Santiago Pastorino) wrote:
> > OWASP suggest escaping &, <, >, ", ' and /
> > https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
> > 
> > About / I don't think could lead to issues but that's another story.
> 
> Agreed.
> 
> > You have the right code in CGI.escapeHTML
> > https://github.com/ruby/ruby/blob/c47cca2f/lib/cgi/util.rb#L36 so my
> > suggestion is to reuse CGI.escapeHTML from ERB::Util
> 
> I and SEKI have discussed it, and have agreed to use cgi/util.
> CGI.escapeHTML has a problem that is uses &apos; instead of &#x27;, but
> xibbar will fix it later.

Shouldn't CGI use ERB?  It seems like ERB's use is for creating HTML,
where CGI is in charge of providing the common gateway interface.

ERB concerns itself with templating and should have knowledge of
template formats / escaping.  It seems CGI would not.

-- 
Aaron Patterson
http://tenderlovemaking.com/