Feed fields which will be fetched from the XML, and which therefore are not fully trusted, are sanitized before model validations (so, every time a model is saved).

This helps but it's not enough. Better to be paranoid than sorry: sanitize helper will also be called from the presentation layer for each of these fields. This is absolutely necessary; consider for instance this possible value for the url field:

   feed.url = "http://xkcd.com\" onclick=\"javascript:alert('pwned!');"

This value will not be changed at all by the sanitize helper, this is, after this:

   feed.url = sanitize feed.url

the value of feed.url is exactly the same as before; the sanitizer does not catch the javascript injection.

If then we build a link to the feed URL in the view like this:

   <a href="<%=feed.url%>">Feed</a>

we will get a link like this in the page:

   <a href="http://xkcd.com" onclick="javascript:alert('pwned!');">Feed</a>

and we will be thoroughly pwned with a javascript injection.

So, it's absolutely necessary to ALSO sanitize these fields in the views like this:

   <%= sanitize link_to('Feed', feed.url) %>

which catches the attempt at javascript injection and removes it:

   <a href="http://xkcd.com">Feed</a>

Nice!
Sanitize in the view all HTML generated using Feed and Entry fields.
Sanitize all fields in the Entry model before saving in the database.

An exception is the "published" field. It doesn't make much sense to sanitize a field that is stored as a Datetime in the database.