rack/rack — comment on commit 37ca2539c423f29337486cf0469dd49a019cfea3
File:  line 0
By thinkerbot:

@richmeyers One solution is to not upgrade. If a previous rack worked, then you have the option to stay with it especially if you don't think that this security fix is necessary for your app.

As someone who has also not written integrity I don't know how to fix your problem. If you were escaping a url for display to the user in a textual context then there should not be a breakage as the browser renders escaped entities as their unescaped characters. For example, from the command line:

echo "<foo></foo>" > example.html
open example.html

If a test is breaking then adjust the test to look for the escaped entities.

Regarding your last statement, I personally don't know if a security issue exists either but that's because I've never studied the issue. OWASP has and so I defer to their recommendations. See [here](http://wonko.com/post/html-escaping). It was enough to assure me that I do not know what I need to know about XSS. And to your question ... 'helps end' and 'part of' are pretty different roles to play wrt HTML entities so no, letters quite likely do not need to be escaped.