When running Merb in development mode, it's possible to inject HTML into the page. Consider this code which calls a method on a string:
`
"asfd".foo
`
This causes Merb to show that fancy "Internal server error" page (which looks really nice and is useful, BTW!), but it doesn't escape the error message. So I can supply nasty input data to the form that submits to the page with the error. Then this gets called:
`
"<script>alert('hi')</script>".foo
`
Since the "Internal server error" page doesn't escape the HTML, I get a nice little JS popup.
I ran into this when I had a string.no_bad_words method in the test app I'm using to learn Merb. When I changed the method name to string.replace_bad_words, I forgot to update my view code and got the error. I found that I could add any text to the textarea in my submitting page to have it included as raw HTML.
Of course, this vulnerability doesn't happen unless you're in development mode, which shouldn't be the case in production apps, obviously.
