Add escaping to the static 404 page.

2020-09-28 15:17:21 +01:00 · 2020-09-28 15:17:21 +01:00 · 8d38b124aa
parent eebec272ce
commit 8d38b124aa
1 changed files with 1 additions and 1 deletions
--- a/lib/sinatra/base.rb
+++ b/lib/sinatra/base.rb
@ -1168,7 +1168,7 @@ module Sinatra

      if not_found? || bad_request?
        if boom.message && boom.message != boom.class.name
-          body boom.message
+          body Rack::Utils.escape_html(boom.message)
        else
          content_type 'text/html'
          body '<h1>' + (not_found? ? 'Not Found' : 'Bad Request') + '</h1>'