Bug #6850: It's not recommended to escape ' to '

• Status: Closed
• Assignee: xibbar (Takeyuki FUJIOKA)
• Target version: 2.0.0
• ruby -v: 2.0.0dev

[spastorino (Santiago Pastorino)]

OWASP doesn't recommend it https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
and ' is not a valid in HTML4 http://www.w3.org/TR/html4/sgml/entities.html

I've made a Pull Request on github too https://github.com/ruby/ruby/pull/154

[xibbar (Takeyuki FUJIOKA)]

• Assignee set to xibbar (Takeyuki FUJIOKA)

[xibbar (Takeyuki FUJIOKA)]

• Status changed from Open to Assigned

[spastorino (Santiago Pastorino)]

I've just updated the pull request to take in consideration https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/36687

[xibbar (Takeyuki FUJIOKA)]

• Status changed from Assigned to Closed
• % Done changed from 0 to 100

This issue was solved with changeset r36692.
Santiago, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.

---

Tue Aug 14 11:55:37 2012 Takeyuki FUJIOKA [e-mail]

• lib/cgi/util.rb (CGI::escapeHTML): ' is not recommended. [Bug #6850]