Rails3 and safe nl2br !

Question

Hi,

I have a system for the users to be able to post comments.

The comments are grasped into a textarea.

My problem is to format the comments with br tag to replace \n

In fact, i could do something like that

s.gsub(/\n/, '<br />')

But the xss protection including in rails escapes br tags.

So i could do this

s.gsub(/\n/, '<br />').html_safe

But then, all the tags are accepted even script.... causing a big security problem

So my question is : how to format text with br safely ?

Thanks

EDIT: For now, i have add this

  def sanitaze
    self.gsub(/(<.*?>)/, '')
  end

  def nl2br
    self.sanitaze.gsub(/\n/, '<br />').html_safe
  end

Answer 1

The best way I can figure to go about this is using the sanitize method to strip all but the BR tag we want.

Assume that we have @var with the content "some\ntext":

Trying <%= @var.gsub(/\n/, '<br />') %> doesn't work.

Trying <%= h @var.gsub(/\n/, '<br />').html_safe %> doesn't work and is unsafe.

Trying <%= sanitize(@var.gsub(/\n/, '<br />'), :tags => %w(br) %> WORKS.

I haven't tested this very well, but it allows the BR tag to work, and replaced a dummy script alert I added with white space, so it seems to be doing its job. If anyone else has an idea or can say if this is a safe solution, please do.

Update:

Another idea suggested by Jose Valim:

<%= h(@var).gsub(/\n/, '<br />') %> Works