Rails Sanitize: Safety + Allowing Embeds

Question

We're building a user generated content site where we want to allow users to be able to embed things like videos, slideshares, etc... Can anyone recommend a generally accepted list of tags / attributes to allow in rails sanitize that will give us pretty good security, while still allowing a good amount of the embedable content / html formatting?

Answer 1

As long as is turned off, you should be able to allow objects. You might even be able to to define the actual acceptable parameters of object tags, so that you only allow a whitelist, and abitrary objects cannot be included.

However, it may be better to provide some UI support for embedding. For example, I prompt the user for a YouTube URL and then derive the embed code for the video from that.

Several benefits: - the default YouTube code is not standards compliant so I can construct my own Object code - I have complete control over the way embedded elements are included in the output page

Answer 2

Honestly saying allowing users to use WYSIWYG Html editors might sound good, but in practice it just doesn't work well for both users and developers. The reasons are:

• Still too different behavior in different browsers.
• Whitelist allows to secure site, but users will end up calling and asking to allow another parameter for OBJECT tag or similar. Blacklists are just not secure.
• Not many users know what HTML tag is.
• For users it is hard to format text (how can you tell them to use HEADER instead of BOLD+FONT-SIZE).
• Generally it is pretty painful and you cannot really change the site design if needed because of users did not properly use HTML.

If I would be doing CMS-like system now, I would probably go with semantic markup.
Most users, get used to it quickly and it is just plain text (as here at SO).

Also YOU can generate proper HTML and support needed tags.
For example if you need to embed picture you might write something like:

My Face:image-http://here.there/bla.gif

Which would generate HTML for you like this:

<a class='image-link' title='My Face' href='http://here.there/bla.gif'&gt;
  <img alt='My Face' src='http://here.there/bla.gif' />
</a>

There are plenty of markup languages around, so just pick the one is more appropriate to you and add your own modifications.

For example, GitHub uses modified markdown and the code to parse it is just a couple of lines.

One disadvantage is that users need to learn the language and it is NOT WYSIWYG.

Regards,
Dmitriy.