This project is archived and is in readonly mode.
auto_link output should be marked .html_safe!
-
Greg HazelWow, actually. Is there a right way to use auto_link with escaping at all?
Say you have a blob of text like:
b = "<foo> http://foo.com?p=1&v=2 </foo>"Passing it through auto_link gives you:
auto_link(b) "<foo> <a href="http://foo.com?p=1&v=2">http://foo.com?p=1&v=2</a> </foo>"Which is right, except you have the unescaped tags in there. Bad. Escaping that string would escape your tag as well, and that would be bad.
Escaping the contents first gives you:
h(b) "<foo> http://foo.com?p=1&v=2 </foo>"So far so good, but passing that to auto_link:
auto_link(h(b)) "<foo> <a href="http://foo.com?p=1&v=2">http://foo.com?p=1&amp;v=2</a> </foo>"produces a string with
&amp;in it. Clearly wrong.How should this be done?
-
Mislav- Tag changed from xss auto_link to auto_link, html, sanitize, xss
There are use cases where developers would pass HTML content to be auto-linked (think HTML comments) and some where they want plaintext content with an occasional link where applicable.
I think that the responsibility of the developer to use a sanitize helper on the final output if they want to be sure there are only allowed tags in the output.
I would like to get some more opinions on this, though
-
Santiago Pastorino- Milestone cleared.
- State changed from new to verified
- Assigned user set to Santiago Pastorino
-
Michael Koziarski- State changed from verified to invalid
auto_link doesn't return safe strings. It makes no effort to remove potentially hostile content.
If you want to use auto_link in a guaranteed safe manner the only option you have is:
<%= sanitize(auto_link(x)) %>
If you believe your particular situation is safe you can use the raw helper, but odds are it's not as safe as you think it is :)
-
Greg Hazel
What about the case I was initially reporting, where the input string is html_safe already?
-
Michael Koziarski
What's the scenario you have in mind? I'm a little bit hesitant to introduce the expectation that the helper will behave differently based on what its inputs are as it breaks the simple-but-provable model that we have now where a helper will only return a safe string if it knows that the string is safe.
Strictly speaking we don't know that with the working of auto_link and the person who does (you) can just as easily add raw to your views?
-
Greg Hazel
Well, auto_link(h(b)) is particularly the use-case I had in mind. I suppose I can write raw(auto_link(h(b))), but that feels a bit odd - as if auto_link doesn't know if it's producing safe html or not..
Honestly though, because that has the above problem I mentioned, I would prefer a auto_link_and_escape function which split up the buffer, escaped the segments which were not urls and linkified the sections which were (marking those html_safe!) then added the whole thing back together. Is that not something anyone else wants?
-
NeerajI would say have two methods: auto_link and auto_link_safe.
-
Michael Koziarski
I think the only reliable way to actually implement auto_link_and_escape would be to implement it as sanitize(auto_link). Users can do that for now so I'm leaving this closed
-
