http://groups.google.com/group/rubyonrails-security/t/2b9130749b74ea12

http://groups.google.com/group/rubyonrails-security/t/6ffc93bde0298768

http://groups.google.com/group/rubyonrails-security/t/6a1e473744bc389b

http://groups.google.com/group/rubyonrails-security/t/3420ac71aed312d6

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195

in method calls like <%= blah(cookies[:snickerdoodle]) %>

(It could happen, I guess)

when they are given user input

Previously, only append= and safe_append= were being
processed, but everything else was ignored. Turns out
there are more methods, though, so just process
everything.

in particular looking in calls to raw()

when looking for immediate output

and using Erubis

because apparently that happens a lot