tenderlove/rails_autolink — pull request #14 by homakov (2012-05-24 10:47:02+00:00)
Title: sanitize after auto_link - #13 XSS vulnerability

First time I was thinking about whitelisting Regexp for URL but it's probably will not include all URI protocols.
then I thought it should be fixed in conditional_html_safe but right now moving sanitize after auto_link solves problem more gracefully.