Skip to content

Commit

Permalink
removes mentions to RJS in the security guide
Browse files Browse the repository at this point in the history
  • Loading branch information
fxn committed Apr 13, 2011
1 parent d8f23ca commit 6cf1fc5
Showing 1 changed file with 0 additions and 6 deletions.
6 changes: 0 additions & 6 deletions railties/guides/source/security.textile
Expand Up @@ -893,12 +893,6 @@ h4. Ajax Injection

If you use the "in_place_editor plugin":http://dev.rubyonrails.org/browser/plugins/in_place_editing, or actions that return a string, rather than rendering a view, _(highlight)you have to escape the return value in the action_. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.

h4. RJS Injection

-- _Don't forget to escape in JavaScript (RJS) templates, too._

The RJS API generates blocks of JavaScript code based on Ruby code, thus allowing you to manipulate a view or parts of a view from the server side. <em class="highlight">If you allow user input in RJS templates, do escape it using +escape_javascript()+ within JavaScript functions, and in HTML parts using +h()+</em>. Otherwise an attacker could execute arbitrary JavaScript.

h4. Command Line Injection

-- _Use user-supplied command line parameters with caution._
Expand Down

0 comments on commit 6cf1fc5

Please sign in to comment.