Escape feed content with Builder rather than by hand

Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.

Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.

config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.

3 files changed, 7 insertions, 7 deletions

diff --git a/app/views/rss/tag_updates.xml.builder b/app/views/rss/tag_updates.xml.builder
index 810ee9aa..9fde2a55 100644
--- a/app/views/rss/tag_updates.xml.builder
+++ b/app/views/rss/tag_updates.xml.builder
@@ -12,7 +12,7 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
 
   @items.each do |item|
     xml.entry do
-      xml.title(CGI.escapeHTML(item.title.to_s))
+      xml.title(item.title.to_s)
       xml.link(
         :href => content_url(:page_path => item.node.unique_path),
         :rel  => "alternate",
@@ -21,7 +21,7 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
       xml.id(content_url(:page_path => item.node.feed_id))
       xml.updated(item.updated_at.xmlschema)
       xml.published(item.published_at.xmlschema)
-      xml.summary(CGI.escapeHTML(item.abstract.to_s))
+      xml.summary(item.abstract.to_s)
     end
   end
 end
diff --git a/app/views/rss/updates.rdf.builder b/app/views/rss/updates.rdf.builder
index b4fecdb0..699e9c87 100644
--- a/app/views/rss/updates.rdf.builder
+++ b/app/views/rss/updates.rdf.builder
@@ -17,9 +17,9 @@ xml.tag!("rdf:RDF", "xmlns:rdf" => "http://www.w3.org/1999/02/22-rdf-syntax-ns#"
 
   @items.each do |item|
     xml.item("rdf:about" => content_url(:page_path => item.node.unique_path)) do
-      xml.title(CGI.escapeHTML(item.title.to_s))
+      xml.title(item.title.to_s)
       xml.link(content_url(:page_path => item.node.unique_path))
-      xml.description(CGI.escapeHTML(item.abstract.to_s))
+      xml.description(item.abstract.to_s)
       xml.tag!("dc:creator", (item.user ? item.user.login : "CCC"))
       xml.tag!("dc:date", item.published_at.xmlschema)
     end
diff --git a/app/views/rss/updates.xml.builder b/app/views/rss/updates.xml.builder
index a2c277d6..f09d6a74 100644
--- a/app/views/rss/updates.xml.builder
+++ b/app/views/rss/updates.xml.builder
@@ -12,7 +12,7 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
   
   @items.each do |item|
     xml.entry do
-      xml.title(CGI.escapeHTML(item.title.to_s))
+      xml.title(item.title.to_s)
       xml.link(
         :href => content_url(:page_path => item.node.unique_path),
         :rel  => "alternate",
@@ -21,8 +21,8 @@ xml.feed(:xmlns => "http://www.w3.org/2005/Atom", "xml:base" => @host) do
       xml.id(content_url(:page_path => item.node.feed_id))
       xml.updated(item.updated_at.xmlschema)
       xml.published(item.published_at.xmlschema)
-      xml.summary(CGI.escapeHTML(item.abstract.to_s))
-      xml.content(CGI.escapeHTML(item.body.to_s), :type => "html")
+      xml.summary(item.abstract.to_s)
+      xml.content(item.body.to_s, :type => "html")
     end
     
   end