RedCloth and Rails

Question

I want use RedCloth gem, i install it, in my gemfile i put -> gem 'RedCloth' in my show.html.erb i put ->

<%= RedCloth.new(@post.text).to_html %>

and i saw simple html syntax, than i use

<%= raw RedCloth.new(@post.text).to_html %>

and it work perfect, it's not safe
@post.text -> puts by some user

and when i put <script> alert('!!!') </script> i saw "!!!" in alert

How to use RedCloth safely ( or recomend another gem )

Check this similar question: http://stackoverflow.com/questions/501737/how-do-i-textile-and-sanitize-html — gparis, Aug 28 '12 at 13:09

score 0 · Accepted Answer · answered Aug 28 '12 at 13:56

0

The sanitize gem https://github.com/rgrove/sanitize/ is a solid choice for whitelisting only certain html elements and blocking others (eg )

answered Aug 28 '12 at 13:56

1 Answers1