5 ms·
The article should have pointed out that Github is running Rails 2.3, and that this is where the problem exists. Rails 3.x has reworked the entire escaping sit
by lobster_johnson 14y ago
The article should have pointed out that Github is running Rails 2.3, and that this is where the problem exists.
Rails 3.x has reworked the entire escaping situation and now avoids the re-escaping trap (strings must be flagged as "HTML safe", otherwise they are escaped on final injection into a document). It still has escape_once, but it's not used by Rails itself.
You are of course right to blame 2.x for its flaws, but let's not blame entire projects for problems that have been fixed. (Not that Rails 3.x does not have other egregious inefficiencies, but that's another story.)
- tmoertel 14y agoI stopped using Rails not so much because of the existence of the escape_once method but because of what its introduction in 2006, and its continued use in mainstream Rails methods (until 2010 when Rails 3.0 was released), said about the direction of the project.
- lobster_johnson 14y agoWhat did it say about the direction of the project, in your opinion? I can see how one might conclude that the developers are idiots based on that method, but I have to say that what I get out of Rails vastly outweighs that stupidity.
- tmoertel 14y agoIt made it hard to believe that the project wouldn't be plagued by security problems. For me, that was enough.
- rhizome 14y agoBut the 3.0 change didn't say anything?
- tmoertel 14y agoOf course it did, but what it said wasn't enough to make me want to start using Rails again.