Skip to content
Ruby on Rails Plugin that automatically wraps html_escape() around ActiveRecord attribute methods associated with string and text fields in the database.
Ruby
Find file
Latest commit 0f26232 Oct 26, 2011 @aaron aaron update rdoc require
Failed to load latest commit information.
lib Fix turning off escaping on methods that call other text fields in ot… Feb 17, 2009
test
MIT-LICENSE
README
Rakefile
init.rb Add ability to fine tune which fields get automatically escaped. Jan 30, 2008

README

= Cross Site Sniper (XSS)

Cross Site Sniper is a Ruby on Rails Plugin that automatically wraps html_escape() around 
ActiveRecord attribute methods associated with string and text fields in the
database.  This provides a convenient and DRY method to protect a Rails site from Cross
Site Scripting (XSS) attacks from malicious users.

Data used to pre-populate form fields is *not* auto escaped, allowing for user friendly
legitimate uses of normally escaped characters and painless integration into 
existing Rails applications without modifying forms or controllers.

You will probably want to remove any calls to h() in helpers and views, otherwise fields
will be double escaped. This will only be of concern however in cases of legitimate uses of
escaped characters, where, for instance, users may actually see '&' displayed on a webpage
instead of an expected '&'.

See the html_escape[link:classes/ActiveRecord/CrossSiteSniperExtensions/ClassMethods.html#M000001] method to fine tune which fields to automatically escape.

== Example

=== Before Cross Site Sniper

* @user.first_name  => "Haxor<script>alert('Gotcha!')</script>"

=== After Cross Site Sniper

Attribute Methods are Automatically Escaped
* @user.first_name => "Haxor&lt;script&gt;alert('Gotcha!')&lt;/script&gt;"

Two convenient ways to get at the unescaped data when needed.
* @user.first_name_without_html_escaping => "HaXor<script>alert('Gotcha!')</script>"
* @quiz[:question] => "True or False, 5/8 < 3/5?"

By not escaping data accessed via the hash method (eg. @quiz[:question]), forms
prepopulate with the *unescaped* data, allowing user friendly legitimate uses of
usually escaped characters. 

Cross Site Sniper also supports calling <method_name>_without_html_escaping on
non-column methods to temporarily disable html escaping for that method call.
(eg. @person.some_computed_value_without_html_escaping)
== Installation

  script/plugin install git://github.com/wwidea/cross_site_sniper.git

== Copyright

Copyright (c) 2008 World Wide IDEA, Inc., released under the MIT license. [ http://www.wwidea.org ]
Something went wrong with that request. Please try again.