Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Ruby on Rails Plugin that automatically wraps html_escape() around ActiveRecord attribute methods associated with string and text fields in the database.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
|Failed to load latest commit information.|
= Cross Site Sniper (XSS) Cross Site Sniper is a Ruby on Rails Plugin that automatically wraps html_escape() around ActiveRecord attribute methods associated with string and text fields in the database. This provides a convenient and DRY method to protect a Rails site from Cross Site Scripting (XSS) attacks from malicious users. Data used to pre-populate form fields is *not* auto escaped, allowing for user friendly legitimate uses of normally escaped characters and painless integration into existing Rails applications without modifying forms or controllers. You will probably want to remove any calls to h() in helpers and views, otherwise fields will be double escaped. This will only be of concern however in cases of legitimate uses of escaped characters, where, for instance, users may actually see '&' displayed on a webpage instead of an expected '&'. See the html_escape[link:classes/ActiveRecord/CrossSiteSniperExtensions/ClassMethods.html#M000001] method to fine tune which fields to automatically escape. == Example === Before Cross Site Sniper * @user.first_name => "Haxor<script>alert('Gotcha!')</script>" === After Cross Site Sniper Attribute Methods are Automatically Escaped * @user.first_name => "Haxor<script>alert('Gotcha!')</script>" Two convenient ways to get at the unescaped data when needed. * @user.first_name_without_html_escaping => "HaXor<script>alert('Gotcha!')</script>" * @quiz[:question] => "True or False, 5/8 < 3/5?" By not escaping data accessed via the hash method (eg. @quiz[:question]), forms prepopulate with the *unescaped* data, allowing user friendly legitimate uses of usually escaped characters. Cross Site Sniper also supports calling <method_name>_without_html_escaping on non-column methods to temporarily disable html escaping for that method call. (eg. @person.some_computed_value_without_html_escaping) == Installation script/plugin install git://github.com/wwidea/cross_site_sniper.git == Copyright Copyright (c) 2008 World Wide IDEA, Inc., released under the MIT license. [ http://www.wwidea.org ]