New RedCloth security
Monday, October 13, 2008 at 6:07PM RedCloth is a module for using Textile in Ruby. Textile is a simple text format that can be converted to HTML, eliminating the need to use HTML directly to create documents, blogs, or web pages.
The new version 4 promises to be faster and without the bugs from version 3. And indeed it feels more reliable and many of the earlier security concers have now been dealt with. For example:
RedCloth.new("<script>alert(1)</script>").to_html
now returns
<script>alert(1)</script>
instead of
<script>alert(1)</script>
in earlier versions. And it's good that it escapes the input instead of deleting malicious parts. I tried many examples from the XSS cheatsheet and hand-crafted ones. The result is that nearly no malicious parts get through. Yes nearly.
The <code> tag gets through:
RedCloth.new('<code onmouseover="bad_code_here">asdf</code>', [:filter_html]).to_html
<code onmouseover="bad_code_here">asdf</code>
I've created a ticket for that.
Also remember that CSS injection will work in textile, if you allow styles. See the earlier post for that.
Nevertheless the new version is far better. And in combination with a whitelist (namely Rails' sanitize() method) it is even secure.
View Printer Friendly Version
Email Article to Friend
Reader Comments (14)
I wanted to thank you for this great read!! I definitely enjoying every little bit of it I have you bookmarked to check out new stuff you post
Portable Air Conditioning Unit
I like your site. It is very simple and fresh, without much office. I will also design my site nice and easy as your
Thin Digital Cameras
Best Thin Digital Camera
Small Thin Digital Cameras
Thin Digital Cameras Reviews
omega watches replicasA typical look at does reflects your wealth, status and ability..
Coach Tote Bags
mbt outlet
mbt shoes
mbt shoes on sale
mbt shoes online
MBT Chapa GTX Shoes
MBT Fanaka GTX Shoes
MBT Karani Shoes
MBT Kisumu Sandals
MBT Lami Shoes
MBT M.WALK Shoes
MBT Shuguli GTX Shoes
MBT Sports Shoes
MBT Tariki Shoes
MBT Women Chapa GTX Shoes
MBT Women Ema Sandals
MBT Women Habari Sandals
MBT Women Kaya Shoes
MBT Women Kisumu Sandals
MBT Women Lami Shoes
MBT Women M.Walk Shoes
MBT Women Salama Sandals
MBT Women Sapatu Shoes
MBT Women Shuguli GTX Shoes
MBT Women Sports Shoes
MBT Women Tunisha Shoes
MBT Women VOI Shoes
coach outlet
if you have any problems with education,buy essay,it will help in learning and save your time
gucci handbags, gucci bags, gucci handbag, gucci wallet, sunglasses gucci, coach outlet, coach handbags, coach bags, coach purses, coach wallet, fendi bags, fendi handbags, hermes bag, hermes handbags, hermes birkin, burberry outlet, burberry bags, burberry handbags, burberry scarf, chanel purses, chanel bags, chanel handbags, chanel sunglasses, chanel handbags, louis vuitton outlet, louis vuitton bags, louis vuitton handbags, louis vuitton wallet, louis vuitton purses, louis vuitton handbags, yves saint laurent, ray ban sunglasses, ray ban wayfarer, ray ban aviator, ray ban sunglasses, tiffany jewelry, tiffany and co, tiffany and company, tiffany engagement rings, tiffany necklace, mac cosmetics, mac cosmetics canada, mac pro, mac cosmetics outlet, balenciaga handbags, prada handbags, nike air max, air max 95, nike air max, air max 1, nike shox nz, nike shox r4, nike shox shoes, air yeezy, adidas shoes, adidas women shoes, dc shoes, gucci shoes, gucci shoes for men, gucci sneakers, lacoste shoes, puma shoes, mbt shoes, prada shoes, timberland shoes, ed hardy shoes, tiffany bracelet, supra shoes, d&g shoes, christian audigier, mbt women's shoes, new balance, adidas jacket, affliction clothing, affliction shirts, ed hardy clothing, ralph lauren polo, polo ralph lauren, abercrombie and fitch, abercrombie shirts, abercrombie jeans, lacoste polo, manolo blahnik, giuseppe zanotti, Alexander Mcqueen, Gianmarco Lorenzi, vibram five fingers, christian louboutin, christian louboutins, christian louboutin sale, nike air force one, nike outlet, nike basketball shoes, nike tennis shoes, nike sneakers, jordans shoes, nike sb dunks, nfl jersey, nfl jerseys, ed hardy jeans, ed hardy women's clothing, ed hardy swimwear, ed hardy bikini, ed hardy t shirts, p90x, p90x workout, p90x results, p90x reviews, spyder jackets, canada goose, north face jacket, north face, jimmy choo shoes, jimmy shoe, armani jeans, boss jeans, calvin klein jeans, diesel jeans, dsquared jeans, jack & jones, levis jeans, lee jeans, ed hardy jeans, true religion jeans, ugg classic short, ugg boots sale, fake uggs, fake uggs, ugg shoes, ugg boots, ugg cardy, ugg bailey button, cheap ugg boots, uggs outlet, ugg boots, ugg boots women, ugg classic tall, ugg classic tall, ugg classic short, ugg classic cardy boot, discount ugg boots, ugg boots on sale, cheap ugg boots, ghd flat iron, ghd irons, ghd iv styler, ghd styler, pink ghd, plancha ghd, ghd mk4, ghd hair straighteners, ghd hair straightener, hair straighteners ghd, ghd purple, christian louboutin pumps, cheap mens jeans, winter jackets, designer handbags, designer bags, designer purses, pumps women's shoes, cheap bags, ghd australia, purple ghds, uggs australia, ugg uk, discount ugg boots, womens uggs, ugg australia women's classic short boots, uggs for sale, ralph lauren polos, abercrombie and fitch outlet, lacoste wholesale, alexander mqueen, nike outlet online, jersey mlb, the north face jacket, diesel jean, true religion sale, dc skate shoes, timberland outlet, d g shoes, gucci bags on sale, coach outlet store, hermes bag, lv handbags, saint laurent, ray ban wayfarer sunglasses, ray ban polarized, prada handbag, wow addon, wow addons, wow addons, blu ray software, christian louboutin shoes, christian louboutin sale, christian louboutin boots, Christian Louboutin Pumps, christian louboutin sale , mbt shoes, mbt womens shoes, mbt shoes clearance, mbt shoes sale
this is a good article.I will keep it and share it whit my friends .I think thay will like it .Richard Mille named his newest uncover of RM011, Felipe Massa Titanium Black replica chopard watches
DLC Grand Prix Brazil.
The young person who answered the rectory timberland boots door said that it was "the woman who said she left all the notes." When I saw her mens timberland boots I was shocked, since I immediately recognized her from church but had no timberland boots outlet idea that it was she who wrote the notes. One Sunday womens timberland boots morning, I was told that someone was waiting for me in timberland 6 boots office.
christian louboutin
christian louboutin pumps
christian louboutin black
christian louboutin sandals
cheap handbags outlets
coach bags
coach pureses
coach handbags
<p>For advanced video playback, command line 2010 corolla radio dvd/gps are provided which allow e39 dvd nav to be fj cruiser car dvd gps in various ways from CD-ROMs, carnavi for bmw e46 the grade is slightly lower, multimedia authoring auto dvd gps system, and scripting languages or batch files.</p>
<p>bmw stereo nav Tucson only plays AVI video files. Any e-fun system car dvd player required by bmw dvd nav player AVI file must be installed before pathfinder dvd gps player play car dvd player video. bmw 3 series touch screen basic Windows multimedia support for playing AVI files must be installed. kia navigaties does not setup any shell associations to become 2003 toyota camry navigation system default AVI player. However, this could be setup by an install program that you provide or by 7" dvd/nav end user.</p>
<p>e53 dvd gps always plays back videos at 100% of bmw dvdnav e39 original size so that bmw touch screen navigation remain readable. dvd systems to fit bmw Player also has e46 hd radio r TechSmith Screen Capture Codec (TSCC) built into it, so you don't have to worry if your users have installed or not.</p>
<h1>coach bags, coach bags</h1>
<h1>vibram shoes, vibram shoes</h1>
<h1>chanel bags, chanel bags</h1>
<h1>MBT Shoes, MBT shoes</h1>
mbt shoes
mbt sneakers
mbts
mbt shoes on sale
cheap mbt shoes
mbts clearance
new mbts
mbt shoes on sale
cheap mbt shoes
mbts discount
high quality mbts
Thanks for an excellent post.how about the nike air jordan shoes here air jordan shoes,
Retro Jordans
Air Jordan 5
cfhfchfDo you have a live demo preview? dog clothing