Pajk/apipie-rails — pull request #164 by bubbagump123 (2013-10-27 06:38:51+00:00)
Title: Cross site scripting vulnerability

The .html_safe ended up being dangerous. Bots were able to add additional 'versions' in the URL which got added to the page without escaping. These got cached in production on the first hit to the url and served to subsequent users. Luckily it was not a targeted attack but would recommend fixing this ASAP.

This is a temp fix which disables the links. But eventual fix should try and prevent additional @versions from being added or sanitize them somehow probably. Thanks!