rack/rack — comment on commit 37ca2539c423f29337486cf0469dd49a019cfea3
File:  line 0
By richmeyers:

@thinkerbot Not upgrading is not a solution. It is a workaround which works until something requires a newer version, and it addresses none of my concerns.

The article you linked to was quite informative. Why then is rack not escaping ` and potentially most (all?) of ascii punctuation? I noticed that the article you linked to, unlike owasp page, does not recommend escaping /, thus it does not explain how unescaped / is a security problem.

With the change made in this commit documentation of escape_html no longer matches its behavior. See https://github.com/rack/rack/blob/37ca2539c423f29337486cf0469dd49a019cfea3/lib/rack/utils.rb#L141. The change made is in fact a clear violation of the claimed purpose of the method, which was to escape a (well known and clearly defined) set of characters. Now it seems escape_html escapes anything it feels like escaping. If rack's escape_html is trying to escape text for a particular purpose, per http://wonko.com/post/html-escaping, what purpose is that? And is that purpose subject to change at any time with no warning or explanation?