square/rails — pull request #15 by nealharris (2014-03-05 01:12:39+00:00)
Title: Remove the use of String#% when formatting durations in log messages

@strzalek patch downloaded form https://groups.google.com/forum/#!topic/ruby-security-ann/yvlR1Vx44c8

This avoids potential format string vulnerabilities where user-provided
data is interpolated into the log message before String#% is called.

Conflicts:
actionpack/lib/action_controller/log_subscriber.rb

Conflicts:
actionpack/lib/action_controller/log_subscriber.rb

Signed-off-by: Neal Harris