Sanitize output in Rails

Question

What is the best solution to sanitize output HTML in Rails (to avoid XSS attacks)?

I have two options: white_list plugin or sanitize method from Sanitize Helper http://api.rubyonrails.com/classes/ActionView/Helpers/SanitizeHelper.html . For me until today the white_list plugin worked better and in the past, Sanitize was very buggy, but as part of the Core, probably it will be under development and be supported for a while.

score 3 · Answer 1 · answered Oct 20 '08 at 01:55

3

I recommend http://code.google.com/p/xssterminate/.

answered Oct 20 '08 at 01:55

Aristotle Pagaltzis

112,955
23
98
97

This solution seems old. Maybe a better coverage is here: http://stackoverflow.com/questions/2985600/how-good-is-the-rails-sanitize-method – Purplejacket Sep 08 '11 at 21:13

score 1 · Accepted Answer · edited Oct 26 '08 at 09:26

1

I think the h helper method will work here:

<%= h @user.profile %>

This will escape angle brackets and therefore neutralize any embedded JavaScript. Of course this will also eliminate any formatting your users might use.

If you want formatting, maybe look at markdown.

edited Oct 26 '08 at 09:26

John Topley

113,588
46
195
237

answered Oct 26 '08 at 09:24

derfred

18,881
3
23
25

score 0 · Answer 3 · answered Oct 27 '08 at 08:37

Personally I think it's not a small decision to accept any HTML entry in any web app. You can test for white/blacklisted tags as much as you like, but unless you're testing for correct nesting, someone could enter a series of closing tags, for example

</td></tr></span></div>

and really mess with your layout.

I'd usually give people something like Textile to enter their markup, since I'd rather spend my time working on business logic than HTML parsing.

Of course, if this text entry is more fundamental to your app (as for example it is for stackoverflow) then you probably should give more attention to hand-rolling your own.

Sanitize output in Rails

3 Answers3