r7kamura/gig — pull request #19 by tmaesaka (2013-03-26 12:08:15+00:00)
Title: Enable filter_html option when constructing Redcarpet::Render::HTML object.

I'm not sure if allowing JS execution is intentional or not but it's certainly troublesome for your current deployment. Here's the problem: http://gig.herokuapp.com/tmaesaka/test

Gig's existing code looks safe from a quick glimpse due to calling html_safe when returning the rendered content. However, the html_safe Rails helper really only marks the string as HTML safe.

What we really want to do here is to make sure that the rendered content is truly safe before constructing the response.

This pull request is pointless if you have plans on vertically separating users by subdomain like Hatena Blog :smile: