rack/rack — comment on commit 37ca2539c423f29337486cf0469dd49a019cfea3
File:  line 0
By richmeyers:

@thinkerbot I almost had to double check if I wrote the changes in question and then forgot all about that, but no, it was not me. It was in fact you. Thanks for volunteering me to fix this mess, but no thanks.

It appears you don't even know what these changes are meant to accomplish. The recommendation to escape slashes is innocuous enough when applied to newly written code, however when an established method is altered to now escape slashes it creates breakage. Fix the documentation? As I already mentioned I do not understand what "escape_html" is meant to do now, with this change applied, or in the future with this sort of approach to modifying published interfaces. I have no intention of guessing how you think escape_html should behave today and I certainly have no desire to alter the documentation from "escapes ampersands, brackets and quotes" to "escapes an undefined and subject to change set of characters".

My suggestion is to revert this commit, putting escape_html back in sync with its documented purpose which is to escape the 5 characters it previously escaped. Then, if you want to escape other characters, especially without defining a sensible policy for what is escaped and what is not escaped, write a separate method for doing so. However, seeing as how there is no html interface between web servers and web frameworks that I'm aware of, it is my opinion that such a method has no place in rack.

I tried to avoid making the following list, but seeing how this discussion is degenerating into absurdity it seems more fitting than not:

* Just because someone posted something on the internet does not make it true.
* Just because someone put a "security" label on something does not make it a security issue.
* If someone did something and you do the same thing in a different context, you might get different results.
* The fact that your changes were merged does not make them any more correct or appropriate.