CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3
CambridgeMike
CambridgeMike

Reputation: 4622

Why should I be careful with html_safe?

From a developer's point of view I understand that HTML safe allows you to put HTML tags/entities in a string from within the controller, and then have that string rendered as HTML in the view.

However, from a security point of view, I'm not sure I understand why it is necessary. When should I not use html_safe on a string? In my case this is a user editable field, but I can't imagine what type of attack this would make possible.

Upvotes: 1

Views: 312

Answers (1)

Jef
Jef

Reputation: 5474

http://guides.rubyonrails.org/security.html

A very clear guide about security issues, including XSS, and why you should escape user-editable content.

Upvotes: 1

Related Questions