I can't replicate this. A bookmark with the example code as name displays correctly on my bookmarks page, performs the search if selected on the Hosts page, and does not trigger the script when loaded - this is true both for admin and a normal user (with view_bookmarks, as tested with Marek's new rbac pr applied). Using Firefox 27.0.

The DB seems to show that no character conversion has occurred during save:

sqlite> select * from bookmarks;
7|<script>alert('xss')</script>|foo|hosts|t|1|User

The HTML of the page confirms it's displaying them safely:

<td><a class=" disabled" disabled="disabled" href="#" onclick="; return false;">&lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;</a></td>

the issue is really with the exception 500 page, as the exception is treated as html safe.

every other place that you can generate an exception based on input will have this issue.

@Greg Sutcliffe, I had no problem to replicate this, ping me if you like to go over it togther

Greg, you must start the rails server in production mode to see the error.