rails/rails — pull request #12762 by ankit8898 (2013-11-04 23:38:13+00:00)
Title: XSS vulnerability in number_to_currency number helper

The unit option passed in `number_to_currency` is not XSS safe.

**Scenario:**

If the current_user has current_currency and the currency has it's symbol. If in free text for setting the currency field a Javascript is executed a XSS will happen.

like:

```
number_to_currency(1.01, unit: "")
```
The XSS prone [example is here](http://hidden-shelf-4318.herokuapp.com) , coming from [this line of code](https://github.com/ankit8898/XSS-prone/blob/master/app/views/users/index.html.erb#L13) of my sample app

This [is the example](http://infinite-taiga-9557.herokuapp.com/users) after the fix from this commit.