Merge pull request #3 from gregmolnar/xss

fix xss in r404 method
zuk · Jul 8, 2014 · 58409f6 · 58409f6
2 parents 92af44b + d335799
commit 58409f6
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/vendor/zuk-camping-2.0.20090429/lib/camping-unabridged.rb b/vendor/zuk-camping-2.0.20090429/lib/camping-unabridged.rb
@@ -362,7 +362,8 @@ def redirect(*a)
     #
     # See: I
     def r404(p)
-      P % "#{p} not found"
+      require 'cgi'
+      P % "#{CGI::escapeHTML(p)} not found"
     end
 
     # If there is a parse error in Camping or in your application's source code, it will not be caught