How good is the Rails sanitize() method?

ruby-on-rails xss sanitize
Tom Lehman picture Tom Lehman · Jun 6, 2010 · Viewed 15.9k times · Source

Can I use ActionView::Helpers::SanitizeHelper#sanitize on user-entered text that I plan on showing to other users? E.g., will it properly handle all cases described on this site?

Also, the documentation mentions:

Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid (conforming to a document type) or even well-formed. The output may still contain e.g. unescaped ’<’, ’>’, ’&’ characters and confuse browsers.

What's the best way to handle this? Pass the sanitized text through Hpricot before displaying?

Answer

Turadg picture Turadg · Feb 17, 2011

Ryan Grove's Sanitize goes a lot farther than Rails 3 sanitize. It ensures the output HTML is well-formed and has three built-in whitelists:

Sanitize::Config::RESTRICTED Allows only very simple inline formatting markup. No links, images, or block elements.

Sanitize::Config::BASIC Allows a variety of markup including formatting tags, links, and lists. Images and tables are not allowed, links are limited to FTP, HTTP, HTTPS, and mailto protocols, and a attribute is added to all links to mitigate SEO spam.

Sanitize::Config::RELAXED Allows an even wider variety of markup than BASIC, including images and tables. Links are still limited to FTP, HTTP, HTTPS, and mailto protocols, while images are limited to HTTP and HTTPS. In this mode, is not added to links.

Related questions

Escaping HTML in Rails

What is the recommended way to escape HTML to prevent XSS vulnerabilities in Rails apps? Should you allow the user to put any text into the database but escape it when displaying it? Should you add before_save filters to …

Read More
Why in Rails 3, <%= note.html_safe %> and <%= h note.html_safe %> give the same result?

It feels like html_safe adds an abstraction to the String class that requires understanding of what is going on, for example, <%= '1 <b>2</b>' %> # gives 1 &lt;b&gt;2&lt;/…

Read More
Preventing HTML character entities in locale files from getting munged by Rails3 xss protection

We're building an app, our first using Rails 3, and we're having to build I18n in from the outset. Being perfectionists, we want real typography to be used in our views: dashes, curled quotes, ellipses et al. This means in …

Read More