rails/rails — pull request #3835 by jenseng (2011-12-02 20:16:13+00:00)
Title: Restore performance of ERB::Util.html_escape

This commit reverts html_escape so we do a single gsub again, **but it also adds the "n" flag** (no
language, i.e. not multi-byte) so that we still protect against XSS via invalid utf8. The output of html_escape should be identical to the bfc4325 version, but it should just run more quickly like it used to.

I moved the existing test into a slightly better spot, and added a couple others. I'm definitely open to better/additional ways of testing this if needed. I've tested it under ruby 1.8.7 and 1.9.2.