How can I sanitize all the parameters included in the Sinatra app?

Question

In a similar Rails application, I managed to create a recursive hash check function, which then runs the sanitize gem cleanup / fragment method to remove any HTML elements from the hash of the incoming parameters. I used the before filter in the application_controller controller, so everything is cleared in the application (this is a big application).

Backstory: XSS attacks were possible, especially in IE browsers, but in reality we just don't want all this data to be stored in a database. Although the ultimate goal was that the JSON output did not contain it.

I tried to do the same in a Sinatra application (which has ActiveSupport and JRuby ActiveRecord), but the Sanitize stone will not be linked because this particular application works in JRuby for some database reasons. Sanitize needs Nokogiri, which in turn needs Nokogumbo, and the latter simply won't build JRuby in this environment.

So, I tried to do the filter before in app.rb using Rack :: Util, a built-in html escape method, but that blew up the application.

Are there any alternative ways that I can think of

1) Sanitizing all incoming parameters to the Sinatra application (JRuby)

And if not, then a smaller option:

2) make all parsed JSON sanitize values ​​in the specified JSON attribute lists?

PS. Part of the problem here is that the included local gem, which handles a lot of parameters and makes JSON rendering, is impossible to debug. I will include Pry in both the host application and the locally linked pearls, and when I try to execute Pry in the Gem, I cannot view the params hash (it just displays as empty) - it seems to be a sphere problem.

Answer 1

Sanitize gem will not bind because this particular application runs in JRuby for some database reasons. Sanitize needs Nokogiri, which in turn needs Nokogumbo, and the latter simply won't build JRuby in this environment.

seems wrong since Nokogiri works in JRuby (has a specific pearl), try bundle update nokogiri so you get Sanitize to play well ...

So, I tried to do the filter before in app.rb using Rack :: Util, a built-in html escape method, but that blew up the application.

again, too bad. perhaps provide details of your gem versions and the failures you encountered. although the preferred option, I think, would be to get something that worked under an MRI running under JRuby - so I will try to use Nokogiri again.

Answer 2

There are two good escape methods in Sinatra. Both are mentioned on the website. http://www.sinatrarb.com/faq.html#escape_html

1) Using Rack . Op said it exploded the application. Could you explain more? Meanwhile, to use the rack method, you can use the following code snippet. After clearing the parameter, you can use this.

 cleanedParam = Rack::Utils.escape_html(params[:some_param_name]) 

2) Using pearls Erubis . Pearls are written in a pure ruby. Set up erubis pearls as follows:

 require 'erubis' set :erb, :escape_html => true 

Once this is done, you can use erubis when displaying the template

 erb :index 

Answer 3

You can iterate over each params hash parameter and use the Rack escape_html method to exclude the HTML elements contained in each parameter.

 params.each do |p, v| params[p] = Rack::Utils.escape_html(v) end 

The documentation for escape_html can be found here .