title: How to fix this XSS in Rails
body: <p>I don't know if it counts as a XSS, but it is causing errors</p>
  
  <p>I have an image_tag and  the <code>:alt</code> tag is generated by the user</p>
  
  <p>however, using <code>sanitize</code>/<code>h</code>/<code>html_escape</code> doesn't help with this (from OWASP- <a href="https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#XSS_Locator" rel="nofollow">here</a>)</p>
  
  <pre><code>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
  alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
  &gt;&lt;/SCRIPT&gt;"&gt;'&gt;&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;
  </code></pre>
  
  <p>when doing</p>
  
  <pre><code>:alt =&gt; (the string above)
  </code></pre>
  
  <p>the output of the image is messed up</p>
  
  <p>Is there a way to fix this XSS? </p>
  
  <p>I'm using latest rails,ruby</p>