Auto sanitized templates with Erubis
Posted by marcel March 16, 2006 @ 06:24 AM
Last month on the Rails core mailing list, a thread popped up (that went on and on) wherein the idea was proposed that rhtml templates should automatically sanitize output by default. After much back and forth, David suggested those in favor redirect their energies toward a working plugin.
Enter stage left, Erubis. It’s a customized implementation of eRuby that provides a handful of features, notably that <%= %> tags automatically sanitize output. You use <%== %> if you don’t want to sanitize the output. For all those who wish rhtml files were sanitized by default, here is your solution.
Configure your Rails apps to use Erubis templates with ActionView::Base::register_template_handler.
So with Erubis it’s <= and <== instead of <=h and <=. Awesome!
So with Erubis it’s <= and <== instead of <=h and <=. Awesome!
Oops, didn’t mean to double-post.
How about auto-textilized (RedCloth) templates?
Maybe we can create plugins for Erubis.
/vendor/plugins/erubis /vendor/plugins/erubis/vendor/plugins/h /vendor/plugins/erubis/vendor/plugins/red_cloth
ruby script/plugin install erubis/red_cloth
Nah just kidding
What does ‘sanatize’ consist of? Does it encode all entities or does it just take care of angle brackets and quotes?
Sanitizing is context-sensitive! E. g. in a JavaScript context you need to look out for other characters than in in a HTML context. Unless Erubis analyses the page and where the tag is placed in the page and then chooses the right kind of sanitization I guess you are creating a false sense of security.
Just my 2c.
I agree with Mike. Not only because of javascript escaping, but also because this implementation won’t help at all with helper methods: you’ll still need to do <%== link_to(h(text)) %>.
Don’t take me wrong: I’d love to see a good safe (auto-sanitized) template rendering, but Erubis as it is does not mix well with the rest of the framework, because of the helpers.
I agree with Mike. Not only because of javascript escaping, but also because this implementation won’t help at all with helper methods: you’ll still need to do <%== link_to(h(text)) %>.
Don’t take me wrong: I’d love to see a good safe (auto-sanitized) template rendering, but Erubis as it is does not mix well with the rest of the framework, because of the helpers.
I tried to set this up today with Erubis but couldn’t get it to work. I got Rails to use Erubis for template parsing but it bombed out on the front page for a reason that I couldn’t quite track down.
Anybody else have this successfully setup? Anybody working on a plugin already?
I think templating systems should quote by default. We went down exactly this route with the OpenACS framework and it worked out great.
Makes sense. Equivalent to SQL-quoting by default.