Merge pull request #1432 from sinatra/fix-1428

escape invalid query params, fixes #1428
sinatra · May 31, 2018 · 3742bdd · 3742bdd
2 parents 5149dc9 + 1278686
commit 3742bdd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
@@ -78,7 +78,7 @@ def unlink?
     def params
       super
     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
-      raise BadRequest, "Invalid query parameters: #{e.message}"
+      raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"
     end
 
     private