How To Sanitize HTML In Rails That Actually Works
Assuming you don’t want to simply escape everything, sanitizing user input is one of the relative weak points of the Rails framework. On SpeakerRate, where users can use Markdown to format comments and descriptions, we’ve run up against some of the limitations of Rails’ built-in sanitization features, so we decided to dig in and fix it ourselves.
In creating our own sanitizer, our goals were threefold: we want to let a subset of HTML in. As the Markdown documentation clearly states, “for any markup that is not covered by Markdown’s syntax, you simply use HTML itself.” In keeping with the Markdown philosophy, we can’t simply strip all HTML from incoming comments, so the included HTML::WhiteListSanitizer is the obvious starting point.
Additionally, we want to escape, rather than remove, non-approved tags, since some commenters want to discuss the merits of, say,
<h2 class="h2">. Contrary to its documentation, WhiteListSanitizer simply removes all non-whitelisted tags. Someone opened a ticket about this issue in August of 2008 with an included patch, but the ticket was marked as resolved without ever applying it. Probably for the best, as the patch introduces a new bug.
Finally, we want to escape unclosed tags even if they belong to the whitelist. An unclosed
<strong> tag can wreak havoc on the rest of a page, not to mention what a
<div> can do. Self-closing tags are okay.
With these requirements in mind, we subclassed HTML::WhiteListSanitizer and fixed it up. Introducing, then:
HTML::StathamSanitizer. User-generated markup, you’re on notice: this sanitizer will take its shirt off and use it to kick your ass. At this point, I’ve written more about the code than code itself, so without further ado:
- module HTML
- def tokenize(text, options)
- super.map do|token|
- if token.is_a?(HTML::Tag)&& options[:parent].include?(token.name)
- def process_node(node, result, options)
- result <<case node
- when HTML::Tag
- if node.closing ==:close && options[:parent].first == node.name
- elsif node.closing !=:self
- options[:parent].unshift node.name
- process_attributes_for node, options
- if options[:tags].include?(node.name)
- bad_tags.include?(node.name)?nil: node.to_s.gsub(/</,“<”)
- bad_tags.include?(options[:parent].first)?nil: node.to_s.gsub(/</,“<”)