David Eisinger

Elsewhere > HTML Sanitization In Rails That Actually Works

Posted 2009-11-23 on viget.com

Assuming you don’t want to simply escape everything, sanitizing user input is one of the relative weak points of the Rails framework. On SpeakerRate, where users can use Markdown to format comments and descriptions, we’ve run up against some of the limitations of Rails’ built-in sanitization features, so we decided to dig in and fix it ourselves.

In creating our own sanitizer, our goals were threefold: we want to let a subset of HTML in. As the Markdown documentation clearly states, “for any markup that is not covered by Markdown’s syntax, you simply use HTML itself.” In keeping with the Markdown philosophy, we can’t simply strip all HTML from incoming comments, so the included HTML::WhiteListSanitizer is the obvious starting point.

Additionally, we want to escape, rather than remove, non-approved tags, since some commenters want to discuss the merits of, say, <h2 class="h2">. Contrary to its documentation, WhiteListSanitizer simply removes all non-whitelisted tags. Someone opened a ticket about this issue in August of 2008 with an included patch, but the ticket was marked as resolved without ever applying it. Probably for the best, as the patch introduces a new bug.

Finally, we want to escape unclosed tags even if they belong to the whitelist. An unclosed <strong> tag can wreak havoc on the rest of a page, not to mention what a <div> can do. Self-closing tags are okay.

With these requirements in mind, we subclassed HTML::WhiteListSanitizer and fixed it up. Introducing, then:

HTML::StathamSanitizer. User-generated markup, you’re on notice: this sanitizer will take its shirt off and use it to kick your ass. At this point, I’ve written more about the code than code itself, so without further ado:

module HTML
  class StathamSanitizer < WhiteListSanitizer

    protected

    def tokenize(text, options)
      super.map do |token|
        if token.is_a?(HTML::Tag) && options[:parent].include?(token.name)
          token.to_s.gsub(/</, "&lt;")
        else
          token
        end
      end
    end

    def process_node(node, result, options)
      result << case node
        when HTML::Tag
          if node.closing == :close && options[:parent].first == node.name
            options[:parent].shift
          elsif node.closing != :self
            options[:parent].unshift node.name
          end

          process_attributes_for node, options

          if options[:tags].include?(node.name)
            node
          else
            bad_tags.include?(node.name) ? nil : node.to_s.gsub(/</, "&lt;")
          end
        else
          bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;")
      end
    end
  end
end

As always, download and fork at the ‘hub.