That Rails has an <i>escape_once</i> method is a big part of the reason I stopped using Rails. If you think "double escaping" is a problem to be solved by creating a helper method that won't escape what's already escaped, now you have two problems.<p>EDIT TO ELABORATE:<p>Problem 1 is the original problem, that parts of your code do not agree upon what a particular string represents. This is the "strings problem," the mother of XSS and injection vulnerabilities. [1]<p>Problem 2 is that the <i>escape_once</i> method papers over these problems, making them harder to detect, and preventing you from hunting down the logic errors that cause them. (Since these errors often occur in upstream code, you need to find them <i>before</i> they execute to be safe, which is why compile-time methods [2] work best.)<p>[1] <a href="http://blog.moertel.com/posts/2007-08-15-a-bright-future-security-and-modern-type-systems.html" rel="nofollow">http://blog.moertel.com/posts/2007-08-15-a-bright-future-sec...</a><p>[2] <a href="http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html" rel="nofollow">http://blog.moertel.com/posts/2006-10-18-a-type-based-soluti...</a>
To people horrified by the Rails code, keep in mind that Github is running Rails 2.3, which is very old and near the end of LTS. Rails 3.x has reworked the entire escaping situation and now avoids the re-escaping trap (strings must be flagged as "HTML safe", otherwise they are escaped on final injection into a document).
"Just by replacing the escaping function with a more optimized one, we've reduced the average request time by 45ms, and we're allocating 20,000 less Ruby objects per request. That was a lot of escaped HTML right there!"<p>I generally stay away from web development so forgive me if this one is obvious, but why does so much text need to have HTML escaping performed in order to render the page? Also is there a way to quantify how much text that is? Like a few K per page or a few hundred K?
Very cool. I'll have to check this out. That profile tool looks interesting too. I've been using the rack-mini-profiler gem but it might be a good idea to do a deeper dive.<p>As always GH, thanks for sharing.
I'm always amazed by these startups doing what _seems_ like really simple optimizations and reaping these enormous benefits. If your tools support profiling, you should at least give it a shot once in a while. The fruit are hanging low indeed if Github can reap this kind of reward with this small a tweak.