rails/turbolinks — pull request #441 by frohoff (2014-12-12 23:29:40+00:00)
Title: Fix XSS vulnerability for html files served up with "Content-Disposition attachment" headers

This is a slightly more complete fix for the XSS issues identified in #195 that covers the case where untrusted user-uploaded html files are served up with "Content-Disposition: attachment" headers (https://github.com/rails/turbolinks/issues/195#issuecomment-52037314). Test case included.