I was looking for the date when RoR changed their templating so it always output sanitized content and I found this:

http://stackoverflow.com/questions/698700/escaping-html-in-r...

Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default?

Edit: RoR added auto-escaping around February 2010, Django had it since November 2007

http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...

You're wrong. It has auto-escaped since Rails 3.

http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/

Rails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood.

Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.

Their (abuse) of the Yaml parser. It is one thing to use a potentially dangerous parser on a file that you aren't going to let anybody touch either (your database config); it is downright stupid to use a dangerous parser on untrused user input (json) a format it shouldn't even parse to begin with.

And as of late tons of similar bugs have been found. CSRF and database parameterization was well known issues when Rails was written, so yeah props for that. It is just not enough anymore.