rack/rack — comment on commit 37ca2539c423f29337486cf0469dd49a019cfea3
File:  line 0
By thinkerbot:

@richmeyers quite right. I recommend you make a pull request to fix the documentation.

If you still have concerns then that is great! It sounds like you have the drive to figure out why or why not / is a problem. If indeed it turns out not a problem then you have a contribution to make to OWASP and later to rack.

I for one think the changes are consistent with the purpose of escape_html, which as *I* understand it is to escape untrusted data before insertion into an HTML context (see rule 1 on the OWASP page). If you read further into the OWASP XSS page you will find the more extensive escaping is recommended for a different use case; ie escaping untrusted data before insertion into HTML attributes (rule 2). If the intent of html_escape is to sanitize untrusted data put into attributes, then yes it probably should escape more characters like [space] % * + , - / ; < = > ^ and |.

Evidently there is some confusion about the intent of escape_html. Again I suggest you take action. Talk to people, determine the common use case of escape_html, and propose patches as you find appropriate. Security is very difficult. I'm sure the community would welcome another expert.