Auto-untaint variables passed through 'escape'

2026-09-15 08:50:45 -07:00 · 2014-09-16 17:23:26 +00:00
parent e836024dd9
commit 1d151885be
1 changed files with 1 additions and 1 deletions
@@ -34,7 +34,7 @@ module Liquid
    end

    def escape(input)
-      CGI.escapeHTML(input) rescue input
+      CGI.escapeHTML(input).untaint rescue input
    end
    alias_method :h, :escape