Sanitizing URL to prevent XSS in Rails

Question

In the rails application, users can create events and post a URL to link to an external event site.

How to clear urls to prevent XSS links?

Thanks in advance,

XSS example that cannot be prevented by rail disinfection

@url = "javascript:alert('XSS')" <a href="<%=sanitize @url%>">test link</a> 

Answer 1

Try disinfection as soon as href is already in the tag, for example:

 url = "javascript:alert('XSS')" sanitize link_to('xss link', url) 

This gives me:

 <a>xss link</a> 

Answer 2

You can use the Rails sanitize method for some basic restrictions.

Or you can use rgrove sanitize gem for more options.

Hope this helps.

Answer 3

sanitize works with html strings, not URLs. this means that you cannot deactivate the url yourself, but you can clear the part of the html that has the link with the malicious url. eg

 <%= sanitize "<a href='#{@url}'>Things</a>" %> 

This will clear your link of all known malicious attributes.

Answer 4

This vulnerability has been fixed since 3.2.13, 3.1.12, 2.3.18.

The following link also contains a patch that you can use in earlier versions.

https://groups.google.com/forum/#!msg/rubyonrails-security/zAAU7vGTPvI/1vZDWXqBuXgJ