«
»

archived blog posts

Protecting your Rails App from XSS

02.25.09 | 2 Comments

I am just sharing this cool new plugin I heard from Greg Moreno in twitter.

xss_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore.

But xss_terminate is also flexible. By default, it will strip all HTML tags from user input. This is usually what you want, but sometimes you need users to be able to enter HTML. The plugin allows you remove bad HTML with your choice of two whitelist-based sanitizers, or to skip HTML sanitization entirely on a per-field basis.

link: http://code.google.com/p/xssterminate/

2 Comments


«
»