rails_xss | rails 2.3.5 applications | Application Framework library

rails_xss is a Ruby library typically used in Server, Application Framework, Ruby On Rails applications. rails_xss has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

This Plugin is for rails 2.3.5, it will not work with later versions. For all later versions you should be using the [rails/rails_xss] version. This plugin replaces the default ERB template handlers with erubis, and switches the behaviour to escape by default rather than requiring you to escape. This is consistent with the behaviour in Rails 3.0. Strings now have a notion of "html safe", which is false by default. Whenever rails copies a string into the response body it checks whether or not the string is safe, safe strings are copied verbatim into the response body, but unsafe strings are escaped first. All the XSS-proof helpers like link_to and form_tag now return safe strings, and will continue to work unmodified. If you have your own helpers which return strings you know are safe, you will need to explicitly tell rails that they’re safe. For an example, take the following helper.