清理 Rails 中的 Markdown？
用户可以在我的应用程序中编辑“文章”。每篇文章都在数据库中掌握并以 Markdown 形式发送到客户端——我使用 Javascript 将其转换为 HTML 客户端。
我这样做是为了当用户想要编辑文章时，他可以编辑并将 Markdown 直接发布回服务器（因为它已经在页面上）。
我的问题是如何清理发送给客户端的 Markdown ——我可以只使用 Rails 的 sanitize 助手吗？
另外，总体上对这种方法有什么想法吗？我想到的另一个策略是在服务器上渲染和清理 HTML，仅当用户想要编辑文章时才将 Markdown 拉到客户端。
Users can edit "articles" in my application. Each article is mastered in the DB and sent to the client as Markdown -- I convert it to HTML client side with Javascript.
I'm doing this so that when the user wants to edit the article he can edit and POST the Markdown right back to the server (since it's already on the page).
My question is how to sanitize the Markdown I send to the client -- can I just use Rails' sanitize helper?
Also, any thoughts on this approach in general? Another strategy I thought of was rendering and sanitizing the HTML on the server, and pulling the Markdown to the client only if the user wants to edit the article.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我遵循几个原则：
这使我想到了您建议的替代架构：
这就是我的方法，而且效果非常好。
I follow a couple principals:
That leads me to the alternative architecture you suggest:
This has been my approach and it works out pretty cleanly.
这里的其他答案都很好，但让我提出一些关于消毒的建议。 Rails 内置的消毒器很不错，但它不能保证格式良好，这往往是问题的一半。它也很可能被利用，因为它不是最好的品种，而且它的安装足迹很大，可供黑客攻击。
我相信当今最好、最具前瞻性的清理是 html5lib，因为它是为像浏览器一样进行解析而编写的，并且它是该领域许多领导者的合作成果。然而它有点慢并且不太像 Ruby。
在 Ruby 中，我推荐 Loofah ，它逐字地提升了一些 html5 清理内容，但使用 Nokogiri 并运行速度要快得多，或者 Sanitize ，它有一个可靠的测试套件和非常好的可配置性（不要让自己陷入困境）不过脚）。
我刚刚发布了一个名为 ActsAsSanitiled 的插件，它是 ActsAsTextiled 的重写，可以自动清理纺织输出以及使用消毒宝石。它旨在为您提供两全其美的功能：数据库中的输入不受影响，而字段始终输出安全的 HTML，而无需记住模板中的任何内容。我自己不使用 Markdown，但我会考虑添加 BlueCloth 支持。
The other answers here are good, but let me make a few suggestions on sanitization. Rails built-in sanitizer is decent, but it doesn't guarantee well-formedness which tends to be half the problem. It's also fairly likely to be exploited since it's not best-of-breed and it has a large large install footprint for hackers to attack.
I believe the best and most forward-looking sanitization around today is html5lib because it's written to parse as a browser does, and it's a collaboration by a lot of leaders in the field. However it's a bit on the slow side and not very Ruby like.
In Ruby I recommend either Loofah which lifts some of the html5 sanitization stuff verbatim, but uses Nokogiri and runs much much faster or Sanitize which has a solid test suite and very good configurability (don't shoot yourself in the foot though).
I just released a plugin called ActsAsSanitiled which is a rewrite of ActsAsTextiled to automagically sanitize the textiled output as well using the Sanitize gem. It's designed to give you the best of both worlds: input is untouched in the DB, yet the field always outputs safe HTML without needing to remember anything in the template. I don't use Markdown myself, but I would consider adding BlueCloth support.
我没有在 Rails 中使用过 Markdown，但我的方法是获取提交的 Markdown 并将其存储在数据库中，以及它的 HTML 渲染和清理副本。这样，您就不会在清理过程中丢弃任何信息，并且每次想要显示文章时都不必重新渲染 Markdown。
Rails 的清理助手应该可以完成这项工作。还有许多插件（例如 xss_shield 和 xss_terminate）可用于将您的输出列入白名单，以确保您不会忘记清理！
I haven't used Markdown in Rails, but my approach would be to take the submitted Markdown and store it, as well as an HTML rendered and sanitized copy of it, in the database. That way you're not throwing any information away in your sanitization, and you're not having to re-render the Markdown every time you want to display an article.
Rails' sanitize helper should do the job. There are also a number of plugins (such as xss_shield and xss_terminate) which can be used to whitelist your output, just to make sure you don't forget to sanitize!