How good is the Rails sanitize() method?

Question

Can I use ActionView::Helpers::SanitizeHelper#sanitize on user-entered text that I plan on showing to other users? E.g., will it properly handle all cases described on this site?

Also, the documentation mentions:

Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid (conforming to a document type) or even well-formed. The output may still contain e.g. unescaped ’<’, ’>’, ’&’ characters and confuse browsers.

What's the best way to handle this? Pass the sanitized text through Hpricot before displaying?

Answer 1

The best course of action depends on two things:

• Your rails version (2.x or 3.x)
• Whether your users are supposed to enter any html at all on the input or not.

As a general rule, I don't allow my users to input html - instead I let them input textile.

On rails 3.x:

User input is sanitized by default. You don't have to do anything, unless you want your users to be able to send some html. In that case, keep reading.

This railscast deals with XSS attacks on rails 3.

On rails 2.x:

If you don't allow any html from your users, just protect your output with the h method, like this:

<%= h post.text %>

If you want your users to send some html: you can use rails' sanitize method or HTML::StathamSanitizer

Answer 2

Sanitize is certainly better than the "h" helper. Instead of escaping everything, it actually allows the html tags that you specify. And yes, it does prevent cross-site scripting because it removes javascript from the mix entirely.

In short, both will get the job done. Use "h" when you don't expect anything other than plaintext, and use sanitize when you want to allow some, or you believe people may try to enter it. Even if you disallow all tags with sanitize, it'll "pretty up" the code by removing them instead of escaping them as "h" does.

As for incomplete tags: You could run a validation on the model that passes html-containing fields through hpricot, but I think this is overkill in most applications.