Escape source_name parameter on RDoc::Servlet.

Patch by @claudijd
ruby · Mar 6, 2018 · 32d9a92 · 32d9a92
1 parent 00d6061
commit 32d9a92
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/rdoc/servlet.rb b/lib/rdoc/servlet.rb
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 require 'rdoc'
+require 'erb'
 require 'time'
 require 'json'
 require 'webrick'
@@ -427,14 +428,14 @@ def store_for source_name
       end
 
       raise WEBrick::HTTPStatus::NotFound,
-            "Could not find gem \"#{source_name}\". Are you sure you installed it?" unless ri_dir
+            "Could not find gem \"#{ERB::Util.html_escape(source_name)}\". Are you sure you installed it?" unless ri_dir
 
       store = RDoc::Store.new ri_dir, type
 
       return store if File.exist? store.cache_path
 
       raise WEBrick::HTTPStatus::NotFound,
-            "Could not find documentation for \"#{source_name}\". Please run `gem rdoc --ri gem_name`"
+            "Could not find documentation for \"#{ERB::Util.html_escape(source_name)}\". Please run `gem rdoc --ri gem_name`"
 
     end
   end