HTML Sanitization In Rails That Actually Works

Assuming you don’t want to simply escape everything, sanitizing user input is one of the relative weak points of the Rails framework. On SpeakerRate, where users can use Markdown to format comments and descriptions, we’ve run up against some of the limitations of Rails’ built-in sanitization features, so we decided to dig in and fix it ourselves.

In creating our own sanitizer, our goals were threefold: we want to let a subset of HTML in. As the Markdown documentation clearly states, “for any markup that is not covered by Markdown’s syntax, you simply use HTML itself.” In keeping with the Markdown philosophy, we can’t simply strip all HTML from incoming comments, so the included HTML::WhiteListSanitizer is the obvious starting point.

Additionally, we want to escape, rather than remove, non-approved tags, since some commenters want to discuss the merits of, say, <h2 class="h2">. Contrary to its documentation, WhiteListSanitizer simply removes all non-whitelisted tags. Someone opened a ticket about this issue in August of 2008 with an included patch, but the ticket was marked as resolved without ever applying it. Probably for the best, as the patch introduces a new bug.

Finally, we want to escape unclosed tags even if they belong to the whitelist. An unclosed <strong> tag can wreak havoc on the rest of a page, not to mention what a <div> can do. Self-closing tags are okay.

With these requirements in mind, we subclassed HTML::WhiteListSanitizer and fixed it up. Introducing, then:

HTML::StathamSanitizer. User-generated markup, you’re on notice: this sanitizer will take its shirt off and use it to kick your ass. At this point, I’ve written more about the code than code itself, so without further ado:

module HTML class StathamSanitizer < WhiteListSanitizer protected def tokenize(text, options) super.map do |token| if token.is_a?(HTML::Tag) && options[:parent].include?(token.name) token.to_s.gsub(/</, "&lt;") else token end end end def process_node(node, result, options) result << case node when HTML::Tag if node.closing == :close && options[:parent].first == node.name options[:parent].shift elsif node.closing != :self options[:parent].unshift node.name end process_attributes_for node, options if options[:tags].include?(node.name) node else bad_tags.include?(node.name) ? nil : node.to_s.gsub(/</, "&lt;") end else bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;") end end end end 

As always, download and fork at the ’hub.