Kemal::ExceptionPage

The exception_page shard renders some values without escaping them, in the <title> element and in the heading right below it. Two of them are attacker controlled: the request path, and the exception message, which applications commonly build from user input (raise "User #{name} not found"). Escape them here, before they reach the template, so the development error page can't be turned into a reflected XSS.

Add an optional link to your project