Recycling user input with Ruby on Rails

Question

I am writing a very simple CRUD application that takes user stories and stores them in a database, so another coder colleague can organize them for a project that we are both working on. However, I had a problem with disinfecting user input before saving it to the database. I cannot call the sanitize () function from the Story model to delete all html / scripting. This requires me to do the following:

def sanitize_inputs self.name = ActionController::Base.helpers.sanitize(self.name) unless self.name.nil? self.story = ActionController::Base.helpers.sanitize(self.story) unless self.story.nil? end 

I want to confirm that user input has been cleared, and I'm not sure of two things: 1) When should user input validation be performed? Before the data is saved, it’s pretty obvious, I’m thinking, however, should I process this stuff in the Controller before checking or some other non-obvious area before I check that user input does not have scripting / html tags? 2) By writing a unit test for this model, how could I verify that the / html script has been deleted, except for the "This is an example of malicious code" comparison for sanitize (example) output?

Thanks in advance.

Answer 1

There are two approaches to fixing XSS vulnerabilities:

A. To filter content before storing it in the database (what are you trying to do). Here are 2 plugins that do this for you.

xss_terminate

acts_as_sanitiled

B. To filter content when it is displayed (Rails 3 does this by default). You can use the h function or use rails_xss .

As in the case of your second question, I think that your unit test should only verify that the sanation method is called, and not the functionality itself (therefore, a simple statement on a basic example should do the trick). By default, sanitation / plugins are already very well tested.

Answer 2

I think the general consensus on disinfection is not. Save the input when the user has entered it, and with the help of the sanitize helper element in the output. (e.g. <%=h @author.filthy_nasty_data %> )

However, you can always use the strip_tags as mentioned in this answer .