defunkt/acts_as_textiled — pull request #4 by liweinan (2012-03-07 16:55:00+00:00)
Title: fix html_regexp leak

acts_as_textiled is currently vulnerable to improperly closed quotes html tag. Here is an example:

}xm
end

It cannot deal with the dirty quotes in html properly. I've tested it on:

ruby 1.8.7 (2010-01-10 patchlevel 249) [universal-darwin11.0]

And here is the code to reproduce the problem:

str = "

}xm
end

str.dup.gsub(html_regexp, '')