tenderlove/rails_autolink — pull request #47 by fcsonline (2014-06-05 05:58:20+00:00)
Title: Fixed XSS issue with link attributes

The current version of auto_link is vulnerable to a XSS attack:

```
https://www.foobar.com/"onmouseover="prompt()
```
you will get
```
https://www.foobar.com/"onmouseover="prompt()
```

**Solution:**

The regexp should find characters until a `"` is found. Then the result is:

```
https://www.foobar.com/"onmouseover="prompt()onmouseover="prompt()"
```