diff --git a/frameworks/Ruby/agoo/app.rb b/frameworks/Ruby/agoo/app.rb index 4ec43676334..8c01a4852ba 100644 --- a/frameworks/Ruby/agoo/app.rb +++ b/frameworks/Ruby/agoo/app.rb @@ -127,7 +127,7 @@ def self.call(_req) f_2 = f_1.map(&:to_h). append({ 'id' => '0', 'message' => 'Additional fortune added at request time.' }). sort_by { |item| item['message'] }. - map { |f| "#{ f['id'] }#{ CGI.escape_html(f['message']) }" }. + map { |f| "#{ f['id'] }#{ ERB::Escape.html_escape(f['message']) }" }. join html_response(<<-HTML) diff --git a/frameworks/Ruby/rack-sequel/hello_world.rb b/frameworks/Ruby/rack-sequel/hello_world.rb index 6a19304f7aa..9b496788da6 100644 --- a/frameworks/Ruby/rack-sequel/hello_world.rb +++ b/frameworks/Ruby/rack-sequel/hello_world.rb @@ -70,7 +70,7 @@ def fortunes html << <<~"HTML" #{fortune.id} - #{CGI.escape_html(fortune.message)} + #{ERB::Escape.html_escape(fortune.message)} HTML end diff --git a/frameworks/Ruby/rack/hello_world.rb b/frameworks/Ruby/rack/hello_world.rb index d2861847a32..c438d7b4c75 100644 --- a/frameworks/Ruby/rack/hello_world.rb +++ b/frameworks/Ruby/rack/hello_world.rb @@ -58,7 +58,7 @@ def fortunes buffer << TEMPLATE_PREFIX fortunes.each do |item| - buffer << "#{item[:id]}#{Rack::Utils.escape_html(item[:message])}" + buffer << "#{item[:id]}#{ERB::Escape.html_escape(item[:message])}" end buffer << TEMPLATE_POSTFIX end diff --git a/frameworks/Ruby/sinatra-sequel/views/fortunes.erb b/frameworks/Ruby/sinatra-sequel/views/fortunes.erb index 67d99d2e55c..6b773ec5dc5 100644 --- a/frameworks/Ruby/sinatra-sequel/views/fortunes.erb +++ b/frameworks/Ruby/sinatra-sequel/views/fortunes.erb @@ -6,7 +6,7 @@ <% @fortunes.each do |fortune| %> <%= fortune.id %> - <%= CGI.escape_html(fortune.message) %> + <%= ERB::Escape.html_escape(fortune.message) %> <% end %> diff --git a/frameworks/Ruby/sinatra/views/fortunes.erb b/frameworks/Ruby/sinatra/views/fortunes.erb index 67d99d2e55c..6b773ec5dc5 100644 --- a/frameworks/Ruby/sinatra/views/fortunes.erb +++ b/frameworks/Ruby/sinatra/views/fortunes.erb @@ -6,7 +6,7 @@ <% @fortunes.each do |fortune| %> <%= fortune.id %> - <%= CGI.escape_html(fortune.message) %> + <%= ERB::Escape.html_escape(fortune.message) %> <% end %>