rack/rack — comment on commit 37ca2539c423f29337486cf0469dd49a019cfea3
File:  line 0
By richmeyers:

@raggi I would like to see the following:

1. Clear separation between security fixes and ordinary changes.
2. Clear separation between changes that break backwards compatibility and ones that do not.
3. If compatibility is broken, at least an acknowledgment of the fact and ideally what needs to be done to keep client code working.

This commit combines a compatibility-breaking security fix, as you say, with a change of spelling for the escaping of the single quote, which is neither and is not needed at all. There already existed an issue explaining the reasoning behind the change when the change was made, yet the issue was not mentioned in the commit.

Regarding "easy to fix", I cannot agree with you. This is the line in question: https://github.com/integrity/integrity/blob/e767171e8a358812e7340e6c290647421c6b815c/views/new.haml#L14 and in rack 1.3 the value displayed is something like "'path'to'repo" instead of "/path/to/repo". As someone who wrote neither rack nor integrity I have no idea how to fix this. I consider myself fortunate to have even located the root cause of the problem as quickly as I have (i.e., in less than a day).

If this is indeed easy to fix, then you should have taken 10 minutes to explain what the fix is instead of making myself and countless other developers, I'm sure, spend hours figuring this out by reading source (which is far from being helpful, see above).

Lastly, with regard to this particular change, I am not convinced that a security issue existed. Neither the owasp page nor the ticket provide an example of how an unescaped slash can cause a security problem. "forward slash is included as it helps end an HTML entity" - well, letters are part of html entities, should they be escaped now too?