pivotal/cacheable-flash — pull request #11 by pedrocarrico (2012-07-17 10:22:00+00:00)
Title: Escape HTML in flash values unless they're html_safe

Flash values were not HTML escaped and that may expose a XSS vulnerability.
Rails 3 automatically does this for us unless we mark the string as html_safe so I added the same behaviour to cacheable-flash.
Hashes and their values are untouched and treated as html_safe.