Recommendation¶

To guard against stored cross-site scripting, consider escaping before using uncontrolled stored values to create HTML content. Some frameworks, such as Rails, perform this escaping implicitly and by default.

Take care when using methods such ashtml_safe orraw. They can be used to emit a string without escaping it, and should only be used when the string has already been manually escaped (for example, with the Railshtml_escape method), or when the content is otherwise guaranteed to be safe (such as a hard-coded string).

Example¶

The following example is safe because theuser.name content within the output tags will be HTML-escaped automatically before being emitted.

<% user = User.find(1) %><p>Hello <%= user.name %>!</p>

However, the following example may be unsafe becauseuser.name is emitted without escaping, since it is marked ashtml_safe. If thename is not sanitized before being written to the database, then an attacker could use this to insert arbitrary content into the HTML output, including scripts.

<% user = User.find(1) %><p>Hello <%= user.name.html_safe %>!</p>

In the next example, content from a file on disk is inserted literally into HTML content. This approach is sometimes used to load script content, such as extensions for a web application, from files on disk. Care should taken in these cases to ensure both that the loaded files are trusted, and that the file cannot be modified by untrusted users.

<script>  <%= File.read(File.join(SCRIPT_DIR, "script.js")).html_safe %></script>

References¶

• OWASP:XSS Ruby on Rails Cheatsheet.

• Wikipedia:Cross-site scripting.

• Common Weakness Enumeration:CWE-79.

• Common Weakness Enumeration:CWE-116.