3 ms·
I'm almost done with upgrading myself and the XSS stuff does take a lot of effort. I am very surprised the Shopify blog says they checked for XSS error manually
by speleding 16y ago
I'm almost done with upgrading myself and the XSS stuff does take a lot of effort. I am very surprised the Shopify blog says they checked for XSS error manually though because it's very easy to add something to your test helper that checks every @response.body for sequences like "<" and runs the result through HTML tidy. That catches 95%.
By the way, a patch of mine is in rails 3.0.3 that just came out and now you can just do a global replace of <%= with <%== and be mostly done with it. But that would be cheating.
- xal 16y agoMan that's a nice idea. I wish we would have had it ourselves during the process.
- speleding 16y agoIn case it helps anyone, this is the helper I used: https://gist.github.com/703175 https://gist.github.com/703175 The tidy lib is installed by default on the Mac. It's very fast (written in C) so it only adds a few seconds to my tests. (I'm leaving it in after the conversion.) Another tip: it helps to put a lot of <&bad"> tags in your fixtures, that will trigger a bunch of errors in the above test if you are not doing your escaping properly.