Geek Answers Handbook

Rails Sanitize: Safety + Allow Embeds

We create a custom content site where we want users to be able to embed things like videos, slide shows, etc. Can anyone recommend a generally accepted list of tags / attributes that allow misinformation in rails to give us good security, but at the same time allow us to create a good amount of inline content / html formatting?

+5
source share
3 answers

While you are disconnected, you should be able to resolve objects. You might even be able to determine the actual acceptable parameters for the object tags, so that you only allow whitelisting, and no objects can be included.

, , . , URL- YouTube, .

: - YouTube , - , .

0

, WYSIWYG Html- , , . :

  • - .
  • " " , OBJECT . .
  • , HTML.
  • ( HEADER BOLD + FONT-SIZE).
  • , , , , HTML.

CMS- , , , .
, ( , SO).

HTML .
, , - :

My Face: image- http://here.there/bla.gif

HTML :

<a class='image-link' title='My Face' href='http://here.there/bla.gif'>
  <img alt='My Face' src='http://here.there/bla.gif' />
</a>

, .

, GitHub markdown, - .

, , WYSIWYG.

,
.

0

. , youtube,

https://github.com/rgrove/sanitize

0

More articles:


All Articles