xss_terminate

xss_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore.

But xss_terminate is also flexible. By default, it will strip all HTML tags from user input. This is usually what you want, but sometimes you need users to be able to enter HTML. The plugin allows you remove bad HTML with your choice of two whitelist-based sanitizers, or to skip HTML sanitization entirely on a per-field basis.

To install, do:

script/plugin install git://github.com/look/xss_terminate.git

HTML sanitization

A note on your choices.

• Strip tags: removes all HTML using Rails's built-in trip_tags method. Tags are removed, but their content is not.
• Rails sanitization: Removes bad HTML with Rails's built-in sanitize method. Bad tags are removed completely, including their content.
• HTML5lib sanitization: Removes bad HTML after parsing it with HTML5lib, a library that parses HTML like browsers do. It should be very tolerant of invalid HTML. Bad tags are escaped, not removed.
• Do nothing. You can chose not to process given fields.

Usage

Installing the plugin creates a before_save hook that will strip HTML tags from all string and text fields. No further configuration is necessary if this is what you want. To customize the behavior, you use the xss_terminate class method.

To exempt some fields from sanitization, use the :except option with a list of fields not to process:

 class Comment < ActiveRecord::Base
   xss_terminate :except => [ :body ]
 end

To sanitize HTML with Rails's built-in sanitization, use the :sanitize option:

  class Review < ActiveRecord::Base
    xss_terminate :sanitize => [ :body, :author_name]
  end

To sanitize HTML with HTML5Lib (gem install html5 to get it), use the :html5lib_sanitize option with a list of fields to sanitize:

 class Entry < ActiveRecord::Base
   xss_terminate :html5lib_sanitize => [ :body, :author_name ]
 end

You can combine multiple options if you have some fields you would like skipped and others sanitized. Fields not listed in the option arrays will be stripped.

 class Message < ActiveRecord::Base
   xss_terminate :except => [ :body ], :sanitize => [ :title ]
 end

Sanitizing existing records

After installing xss_terminate and configuring it to your liking, you can run rake xss_terminate MODELS=Foo,Bar,Baz to execute it against your existing records. This will load each model found and save it again to invoke the before_save hook.

Unique features

xss_terminate is based on acts_as_sanitized. Here is what's different:

• Rails 2.0-ready.
• Automatic. It is included with default options in ActiveReord::Base so all your models are sanitized.
• It works with migrations. Columns are fetched when model is saved, not when the class is loaded.
• You can decide whether to sanitize or strip tags on a field-by-field basis instead of model-by-model.
• HTML5lib support.

TODO

• Performance tests
• Test suites with "real world" HTML
• Test/make work with Rails 1.2.x (Rails 1.2 sanitization is crap, so you'd want to use HTML5lib)

Credits

Written by Luke Francl and based on acts_as_sanitized by Alex Payne.

HTML5Lib sanitization by Jacques Distler.

License

MIT License, except for lib/html5lib_sanitize.rb which is under the Ruby license and copyright to Jacques Distler.

Other options

• xss-shield - automatically h() strings unless marked as "safe"
• sanitize_params - sort of like xss_terminate but it works on the controller level.
• SafeErb - does not allow strings not marked untainted to be displayed.
• Erubis - can auto-escape HTML by default. Use in conjuction with xss_terminate if you're truly paranoid!