Module: Amrita::Sanitizer

Module Amrita::Sanitizer |
In: | lib/amrita/format.rb

This module provide methods for avoid XSS vulnerability taken from IPA home page(Japanese) www.ipa.go.jp/security/awareness/vendor/programming/a01_02.html

Methods

sanitize_attribute_value sanitize_text sanitize_url

Public Instance methods

sanitize_text(text)

escape &<>

    # File lib/amrita/format.rb, line 21
        def sanitize_text(text)
          s = text.dup
          s.gsub!(AMP_WITHOUT_REFRENCE, '&amp;')
          s.gsub!("<", '&lt;')
          s.gsub!(">", '&gt;')
          s
        end

sanitize_attribute_value(text)

escape &<>"'

    # File lib/amrita/format.rb, line 30
        def sanitize_attribute_value(text)
          s = text.dup
          s.gsub!(AMP_WITHOUT_REFRENCE, '&amp;')
          s.gsub!("<", '&lt;')
          s.gsub!(">", '&gt;')
          s.gsub!('"', '&quot;')
          s.gsub!("'", '&#39;')
          s
        end

sanitize_url(text, allowd_scheme = DefaultAllowedScheme)

`sanitize_url` accepts only these characters

        --- http://www.ietf.org/rfc/rfc2396.txt ---
        uric = reserved | unreserved | escaped
        reserved = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" | "$" | ","
        unreserved = alphanum | mark
        mark = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
        escaped = "%" hex hex

`sanitize_url` accepts only schems specified by `allowd_scheme`

The default is http: https: ftp: mailt:

    # File lib/amrita/format.rb, line 62
        def  sanitize_url(text, allowd_scheme = DefaultAllowedScheme)
          # return nil if text has characters not allowd for URL

          return nil if text =~ UrlInvalidChar

          # return '' if text has an unknown scheme
          # --- http://www.ietf.org/rfc/rfc2396.txt ---
          # scheme = alpha *( alpha | digit | "+" | "-" | "." )

          if text =~ |^([A-Za-z][A-Za-z0-9+\-.]*):|
            return nil unless allowd_scheme[$1]
          end

          # escape HTML
          # special = "&" | "<" | ">" | '"' | "'"
          # But I checked  "<" | ">" | '"' before.
          s = text.dup
          #s.gsub!("&", '&amp;')
          s.gsub!("'", '&#39;')

          s
        end