From 1d151885beb2de36ae69efec9e27a4881ee5d814 Mon Sep 17 00:00:00 2001
From: Evan Huus <eapache@gmail.com>
Date: Fri, 12 Sep 2014 17:34:53 +0000
Subject: [PATCH] Auto-untaint variables passed through 'escape'

---
 lib/liquid/standardfilters.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/liquid/standardfilters.rb b/lib/liquid/standardfilters.rb
index 8cf51ea1..bbbda38c 100644
--- a/lib/liquid/standardfilters.rb
+++ b/lib/liquid/standardfilters.rb
@@ -34,7 +34,7 @@ module Liquid
     end
 
     def escape(input)
-      CGI.escapeHTML(input) rescue input
+      CGI.escapeHTML(input).untaint rescue input
     end
     alias_method :h, :escape