导轨消毒：安全 +允许嵌入
我们正在构建一个用户生成的内容网站，我们希望允许用户能够嵌入视频、幻灯片等内容...任何人都可以推荐一个普遍接受的标签/属性列表，以允许在 Rails 清理中提供给我们相当好的安全性，同时仍然允许大量的可嵌入内容/html 格式？
We're building a user generated content site where we want to allow users to be able to embed things like videos, slideshares, etc... Can anyone recommend a generally accepted list of tags / attributes to allow in rails sanitize that will give us pretty good security, while still allowing a good amount of the embedable content / html formatting?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
只要关闭，您就应该能够允许对象。您甚至可以定义对象标签的实际可接受的参数，以便只允许白名单，并且不能包含任意对象。
然而，为嵌入提供一些 UI 支持可能会更好。例如，我提示用户输入 YouTube URL，然后从中导出视频的嵌入代码。
几个好处：
- 默认的 YouTube 代码不符合标准，因此我可以构建自己的对象代码
- 我可以完全控制嵌入元素包含在输出页面中的方式
As long as is turned off, you should be able to allow objects. You might even be able to to define the actual acceptable parameters of object tags, so that you only allow a whitelist, and abitrary objects cannot be included.
However, it may be better to provide some UI support for embedding. For example, I prompt the user for a YouTube URL and then derive the embed code for the video from that.
Several benefits:
- the default YouTube code is not standards compliant so I can construct my own Object code
- I have complete control over the way embedded elements are included in the output page
老实说，允许用户使用所见即所得的 Html 编辑器听起来不错，但在实践中，它对用户和开发人员来说都效果不佳。原因是：
如果我现在要做类似 CMS 的系统，我可能会使用语义标记。
大多数用户很快就会习惯它，它只是纯文本（如此处所示）。
您还可以生成正确的 HTML 并支持所需的标签。
例如，如果您需要嵌入图片，您可以编写如下内容：
这将为您生成 HTML像这样：
周围有很多标记语言，因此只需选择一种更适合您并添加您自己的修改即可。
例如，GitHub 使用修改后的
markdown，解析它的代码只是一个 几行。一个缺点是用户需要学习该语言，而且它不是所见即所得。
问候，
德米特里。
Honestly saying allowing users to use WYSIWYG Html editors might sound good, but in practice it just doesn't work well for both users and developers. The reasons are:
If I would be doing CMS-like system now, I would probably go with semantic markup.
Most users, get used to it quickly and it is just plain text (as here at SO).
Also YOU can generate proper HTML and support needed tags.
For example if you need to embed picture you might write something like:
Which would generate HTML for you like this:
There are plenty of markup languages around, so just pick the one is more appropriate to you and add your own modifications.
For example, GitHub uses modified
markdownand the code to parse it is just a couple of lines.One disadvantage is that users need to learn the language and it is NOT WYSIWYG.
Regards,
Dmitriy.
有一个很棒的项目可以做到这一点。它甚至具有嵌入分析功能，仅允许 YouTube 嵌入，例如
https://github.com/rgrove/sanitize
There's a great project for this. It even has embed-analysis to only allow youtube embeds, for example
https://github.com/rgrove/sanitize