4 ms·
For people using Rails, sanitize all input before it goes in. Here's a library for web params. http://code.google.com/p/sanitizeparams/ http://code.google.com/p
by tonystubblebine 17y ago
For people using Rails, sanitize all input before it goes in. Here's a library for web params.
http://code.google.com/p/sanitizeparams/ http://code.google.com/p/sanitizeparams/
- there 17y agoso when some new technique comes out down the road that your input filtering didn't catch, are you going to update everything in your database? and what about data that gets in from other sources? i don't see the benefit in filtering input; html and alert()'s inside a database don't affect anything until they come back out.
- mbrubeck 17y agoAlso, proper sanitization is different for HTML, JavaScript, SQL, URIs, and other contexts.
- tonystubblebine 17y agoThe question is specifically about XSS, so the context is by definition HTML and Javascript.
- tonystubblebine 17y agoThe benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it up on an output-by-output method. I like the input technique because it only needs to be configured once. I think the risk of new techniques getting by this filter are low (although the risk of the filter having bugs is high, as judged by the number of bugs that popup in more critical software). In XSS there are only a limited set of attack vectors (iframe, javascript, flash), and those get filtered completely. The underlying filter is based on whitelisting, so it's not like new additions to the HTML spec are going to open security holes before we have a chance to close them (it's the opposite, new, safe HTML additions will need to be explicitly allowed before they can be used).