alphagov/bouncer — pull request #29 by jamiecobbett (2013-11-28 18:49:53+00:00)
Title: Escape all database content by default

This should make it hard to introduce an XSS vulnerability.

For example, before, if you had been able to get a malicious HTML or JS value into one of the database fields we render, it would have been rendered by the browser as HTML/JS, and provided an attack vector.

Escaping by default is the same behaviour as Rails >3, although the implementation differs.