hns/stick — pull request #25 by grob (2012-01-03 18:54:21+00:00)
Title: xss possible in notfound middleware

the notfound response html code contains the unmodified request scriptName and pathInfo, which allows xss. the pull request encodes scriptName too just to be sure (i don't know if this is really necessary).