playframework/Play20 — pull request #608 by jroper (2012-12-12 03:08:01+00:00)
Title: [#888] Implemented new HTML escaping

* Implemented a new HTML escaper - commons-lang didn't escape single quote, and also escaped about 100 extra entities that don't need escaping since we are using UTF-8 everywhere.
* Fixed a potential XSS in toHtmlArgs, since the attribute values could contain user data, they should be escaped (and should be escaped for correctness anyway)
* Minor performance improvement, since when escaping we end up with a StringBuilder, and the first thing Html did was convert the String to a StringBuilder, no need to use an intermediate string between them. The old String constructor (and companion object apply method) have been added for backwards compatibility.