Tue Aug 14 11:55:37 2012 Takeyuki FUJIOKA <xibbar@ruby-lang.org>

* lib/cgi/util.rb (CGI::escapeHTML): ' is not recommended. [Bug #6850]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@36692 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

lib/cgi/util.rb

@@ -22,7 +22,7 @@ class CGI
 
   # The set of special characters and their escaped values
   TABLE_FOR_ESCAPE_HTML__ = {
-    "'" => ''',
+    "'" => ''',
     '&' => '&',
     '"' => '"',
     '<' => '&lt;',

test/cgi/test_cgi_util.rb

@@ -54,7 +54,7 @@ class CGIUtilTest < Test::Unit::TestCase
   end
 
   def test_cgi_escapeHTML
-    assert_equal(CGI::escapeHTML("'&\"><"),"&apos;&amp;&quot;&gt;&lt;")
+    assert_equal(CGI::escapeHTML("'&\"><"),"&#x27;&amp;&quot;&gt;&lt;")
   end
 
   def test_cgi_unescapeHTML

test/erb/test_erb.rb

@@ -40,7 +40,7 @@ class TestERB < Test::Unit::TestCase
 
   def test_html_escape
     # TODO: &apos; should be changed to &#x27;
-    assert_equal(" !&quot;\#$%&amp;&apos;()*+,-./0123456789:;&lt;=&gt;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
+    assert_equal(" !&quot;\#$%&amp;&#x27;()*+,-./0123456789:;&lt;=&gt;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
                  ERB::Util.html_escape(" !\"\#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"))
 
     assert_equal("", ERB::Util.html_escape(""))