Skip to content
This repository


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

A plugin for rails 2.3 apps which switches the default to escape by default

branch: master

Fetching latest commit…


Cannot retrieve the latest commit at this time

Octocat-spinner-32 lib
Octocat-spinner-32 test
Octocat-spinner-32 MIT-LICENSE
Octocat-spinner-32 README.markdown
Octocat-spinner-32 Rakefile
Octocat-spinner-32 init.rb

Opt-in RailsXss

This fork of rail-xss provides the benefit of "html safe" strings and escaping by default on an opt-in basis. This is especially useful for large projects like weplay where it's impractical to fix everything at once.

Using this version of the plugin, automatic html escaping is turned off by default. It can be enabled using "autoescape" block helper.

    <% autoescape do %>
            <%= content_helper_gets_escaped %>
    <% end %>

Everything within the helper is escaped. Anything outside the helper is not escaped. Nesting autoescapes is ok: everything inside the outermost invocation is escaped.

    <%= content_helper_not_escaped %>

    <% autoescape do %>
            <%= content_helper_gets_escaped %>
        <% autoescape do %>
                <%= content_helper_gets_escaped %>
        <% end %>

    <% end %>

    <%= content_helper_not_escaped %>




All the XSS-proof helpers like link_to and form_tag now return safe strings, and will continue to work unmodified. If you have your own helpers which return strings you know are safe, you will need to explicitly tell rails that they're safe. For an example, take the following helper.

def some_helper
  (1..5).map do |i|

With this plugin installed, the html will be escaped. So you will need to do one of the following:

1) Use the raw helper in your template. raw will ensure that your string is copied verbatim into the response body.

<%= raw some_helper %>

2) Mark the string as safe in the helper itself:

def some_helper
  (1..5).map do |i|

3) Use the safe_helper meta programming method:

module ApplicationHelper
  def some_helper
  safe_helper :some_helper



<%= params[:own_me] %>        => XSS attack
<%=h params[:own_me] %>       => No XSS
<%= @blog_post.content %>     => Displays the HTML


<%= params[:own_me] %>        => No XSS
<%=h params[:own_me] %>       => No XSS (same result)
<%= @blog_post.content %>     => *escapes* the HTML
<%= raw @blog_post.content %> => Displays the HTML


textilize and simple_format do not return safe strings

Both these methods support arbitrary HTML and are not safe to embed directly in your document. You'll need to do something like:

<%= sanitize(textilize(@blog_post.content_textile)) %>

Safe strings aren't magic.

Once a string has been marked as safe, the only operations which will maintain that HTML safety are String#<<, String#concat and String#+. All other operations are safety ignorant so it's still probably possible to break your app if you're doing something like

value = something_safe
value.gsub!(/a/, params[:own_me])

Don't do that.

String interpolation won't be safe, even when it 'should' be

value = "#{something_safe}#{something_else_safe}"
value.html_safe? # => false

This is intended functionality and can't be fixed.

Getting Started

  1. Install rails 2.3.8 or higher, or freeze rails from 2-3-stable.
  2. Install erubis (gem install erubis)
  3. Install this plugin (ruby script/plugin install git://
  4. Report anything that breaks.

Copyright (c) 2009 Koziarski Software Ltd, released under the MIT license. For full details see MIT-LICENSE included in this distribution.

Something went wrong with that request. Please try again.