Rails sanitize() 方法有多好？
我可以使用 ActionView::Helpers::SanitizeHelper#sanitize我计划向其他用户显示的用户输入的文本？例如，它能否正确处理本网站描述的所有案例？
此外，文档还提到：
请注意消毒 用户提供的文本不保证 结果标记有效 （符合文档类型）或 甚至是结构良好的。输出可能仍然 包含例如未转义的 '<'、'>'、'&' 字符并混淆浏览器。
处理这个问题的最佳方法是什么？在显示之前通过 Hpricot 传递清理后的文本？
Can I use ActionView::Helpers::SanitizeHelper#sanitize on user-entered text that I plan on showing to other users? E.g., will it properly handle all cases described on this site?
Also, the documentation mentions:
Please note that sanitizing
user-provided text does not guarantee
that the resulting markup is valid
(conforming to a document type) or
even well-formed. The output may still
contain e.g. unescaped ’<’, ’>’, ’&’
characters and confuse browsers.
What's the best way to handle this? Pass the sanitized text through Hpricot before displaying?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Ryan Grove 的 Sanitize 比 Rails 3
sanitize走得更远。它确保输出 HTML 格式良好，并具有三个内置白名单：Sanitize::Config::RESTRICTED
仅允许非常简单的内联格式化标记。没有链接、图像或块元素。
清理::配置::基本
允许各种标记，包括格式化标签、链接和列表。不允许使用图像和表格，链接仅限于 FTP、HTTP、HTTPS 和 mailto 协议，并且向所有链接添加属性以减少 SEO 垃圾邮件。
Sanitize::Config::RELAXED 允许比 BASIC 更广泛的标记，包括图像和表格。链接仍仅限于 FTP、HTTP、HTTPS 和 mailto 协议，而图像仅限于 HTTP 和 HTTPS。在此模式下，不会添加到链接。
Ryan Grove's Sanitize goes a lot farther than Rails 3
sanitize. It ensures the output HTML is well-formed and has three built-in whitelists:Sanitize::Config::RESTRICTED
Allows only very simple inline formatting markup. No links, images, or block elements.
Sanitize::Config::BASIC
Allows a variety of markup including formatting tags, links, and lists. Images and tables are not allowed, links are limited to FTP, HTTP, HTTPS, and mailto protocols, and a attribute is added to all links to mitigate SEO spam.
Sanitize::Config::RELAXED Allows an even wider variety of markup than BASIC, including images and tables. Links are still limited to FTP, HTTP, HTTPS, and mailto protocols, while images are limited to HTTP and HTTPS. In this mode, is not added to links.
Sanitize 肯定比“h”助手更好。它实际上允许您指定的 html 标签，而不是转义所有内容。是的，它确实可以防止跨站点脚本编写，因为它完全从混合中删除了 javascript。
简而言之，两者都会完成工作。当您不期望明文以外的任何内容时，请使用“h”；当您希望允许某些内容或您认为人们可能会尝试输入它时，请使用“sanitize”。即使您不允许使用清理功能的所有标签，它也会通过删除它们来“美化”代码，而不是像“h”那样转义它们。
至于不完整的标签：您可以对通过 hpricot 传递包含 html 的字段的模型运行验证，但我认为这在大多数应用程序中都太过分了。
Sanitize is certainly better than the "h" helper. Instead of escaping everything, it actually allows the html tags that you specify. And yes, it does prevent cross-site scripting because it removes javascript from the mix entirely.
In short, both will get the job done. Use "h" when you don't expect anything other than plaintext, and use sanitize when you want to allow some, or you believe people may try to enter it. Even if you disallow all tags with sanitize, it'll "pretty up" the code by removing them instead of escaping them as "h" does.
As for incomplete tags: You could run a validation on the model that passes html-containing fields through hpricot, but I think this is overkill in most applications.
最佳的操作方案取决于两件事：
作为一般规则，我不允许我的用户输入 html - 相反，我让他们输入纺织品。
在 Rails 3.x 上：
默认情况下会对用户输入进行清理。您不必执行任何操作，除非您希望用户能够发送一些 html。在这种情况下，请继续阅读。
此railscast处理rails 3上的XSS攻击。
在rails 2.x上：
如果您不允许用户发送任何html，只需使用
h方法保护您的输出，如下所示：如果您希望用户发送一些html：您可以使用rails的
sanitize方法或 HTML::StathamSanitizerThe best course of action depends on two things:
As a general rule, I don't allow my users to input html - instead I let them input textile.
On rails 3.x:
User input is sanitized by default. You don't have to do anything, unless you want your users to be able to send some html. In that case, keep reading.
This railscast deals with XSS attacks on rails 3.
On rails 2.x:
If you don't allow any html from your users, just protect your output with the
hmethod, like this:If you want your users to send some html: you can use rails'
sanitizemethod or HTML::StathamSanitizer