xss_terminate now Rails 2.2 ready; code now on GitHub

Posted by Luke Francl
on Friday, December 19

I had some coffee a bit too late yesterday and it inspired me to a boost of productivity on xss_terminate, my plugin that escapes HTML from your models when you save them.

xss_terminate now supports Rails 2.2. It is backwards compatible with Rails 2.0 and 2.1.

I also moved the plugin source to GitHub, and incorporated a bug fix from redinger.

You can install it using

script/plugin install git://github.com/look/xss_terminate.git

Comments

Leave a response

  1. Barry Hess – December 19, 2008 @ 06:55 PM

    Thanks, Luke! I’m going to be upgrading Co-op to Rails 2.2 in the next couple weeks and this will help a bunch.

  2. Joe Van Dyk – December 19, 2008 @ 11:41 PM

    I wrote about the same plugin a few months ago. http://github.com/joevandyk/fixie_whitelister

    It automatically sanitizes the stuff in the request params.

  3. Joe – December 20, 2008 @ 12:42 AM

    Link to Fixie Whitelister

  4. Luke Francl – December 23, 2008 @ 09:45 PM

    Cool, Joe. My plugin works similarly but it sanitizes in before_save.

    Another good one (especially for paranoiacs) is Cross Site Sniper. It sanitizes on the way out of the database. You can use it in combination with sanitizing on the way in for double protection.

  5. Thomas Glasgow – December 29, 2008 @ 12:40 PM

    Hi Luke,

    Your plugin works like a charm and is a must have for everyone. Thanks for having kept it maintained and having hosted it at github.

    Best regards,

  6. Thomas Glasgow – December 31, 2008 @ 11:19 AM

    Crap! That plugin is not maintained or badly! I updated my website, and in production mode I get the following error message:

    NameError (uninitialized constant XssTerminate::InstanceMethods::RailsSanitize):

    I was really pissed off.

    I have found the following ‘related’ issue and fix:http://code.google.com/p/xssterminate/issues/detail?id=3#c0

    So does it work or shall I simply move on to another plugin, or better, write my own?

  7. Thomas Glasgow – January 01, 2009 @ 05:24 AM

    Sorry for being so harsh yesterday. I wanted to do the last update of the year, and it got me nervous when I saw my website crash due to xss_terminate just before celebrating the new year. If I find the cause of the problem I will submit a patch.

    Best wishes for 2009

  8. Thomas Glasgow – January 01, 2009 @ 03:13 PM

    On this blog: monkey island code , I have found a way to fix the bug. You have to put the following code in an initializer: @ RailsSanitize.class_eval do

    def self.full_sanitizer
  @full_sanitizer ||= HTML::FullSanitizer.new
end

    end @

  9. Luke Francl – January 02, 2009 @ 02:35 PM

    Thomas, if you read the blog post you’ll note that one of the changes I just made was Rails 2.2 compatibility.

    You can get the Rails 2.2 compatable code from GitHub like this:

    script/plugin install git://github.com/look/xss_terminate.git

  10. Thomas Glasgow – January 14, 2009 @ 03:16 AM

    Hi Luke,

    If checked out your github code, and it still doesn’t work out of the box in production mode when I submit data through a POST request. I still need to add the initializer I talked about in my previous comment. Maybe your github code is not in sync with your latest code?

    Best regards,

  11. Luke Francl – January 16, 2009 @ 11:11 AM

    Please submit a bug to the issue tracker: http://code.google.com/p/xssterminate/issues/list

    Include the stack trace and what version of Rails you are using.

    I have to say that I am using this in production in Rails 2.0.5, 2.1.2 and 2.2.2 with no problems.

  12. Thomas Glasgow – January 17, 2009 @ 02:52 PM

    Hi Luke,

    I tested using a freshly scaffolded rails app, and it worked without the initializer. There might be an incompatibility with one of my other plugins.

    If I found which one, I’ll let you know.