清理 Rails 中的输入 XSS 和 HTML 输入
我知道我可以在视图中使用 ActionView 帮助器 strip_tags 方法来清理输出，但是在将用户输入保存到数据库之前清理用户输入的最佳方法是什么？我是否应该找到一种方法将视图助手包含在我的控制器中并重用 strip_tags 方法？我认为 Rails 将在全球范围内提供一些可用的东西来完成类似的事情。
I know I can use the ActionView helper strip_tags method in my views to sanitize output, but what is the best way to sanitize user input before I persist it to my db? Should I find a way to include the view helper in my controller and reuse the strip_tags method? I thought rails would have something available globally to do something like this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
xss_terminate 插件怎么样？
What about the xss_terminate plugin ?
也许消毒宝石：http://wonko.com/post/sanitize
maybe sanitize gem: http://wonko.com/post/sanitize
为什么需要清理用户的输入？
通常，每次打印或将其嵌入到更大的输出块中时，所需要的只是对用户输入进行严格的、上下文感知的编码/转义。
Why do you need to sanitize the user's input?
Typically, all that is needed is rigorous, context-aware encoding/escaping of the user's input any time you print it or embed it within a larger block of output.
为什么要清理用户输入？这甚至没有任何意义！您总是希望清理（转义）输出，而不是输入，因为清理的含义取决于您使用内容的上下文。在任何上下文中都不存在安全的字符串。您不希望数据库中的一堆损坏的字符串在您的应用程序今天使用它们的任何场景中都是“安全的”，因为明天您可能想要对它们做一些不同的事情。如果您的表示层正在做正确的事情（根据上下文转义内容），那么无论其中有多少引号、反斜杠或 DROP TABLE 语句，您都可以。
Why do you want to sanitize user inputs? That doesn't even make any sense! You always want to sanitize (escape) outputs, not inputs, because the meaning of sanitization depends on the context that you are using the content in. There is no such thing as a string that is safe in any context. You do not want a bunch of mangled strings in your database that are "safe" in whatever scenario your application is using them today, because tomorrow, you might want to do something different with them. If your presentation layer is doing the right thing (escaping content based on the context), then you're fine, no matter how many quotes, backslashes or DROP TABLE statements are in them.