How to prevent user content from messing up my markup?

rubyonrails-talk
1

On my website, I have a page that allows users to leave comments. I'm using Rick Olson's Whitelist plugin (http://svn.techno-weenie.net/ projects/plugins/white_list/) to only allow a, b and i tags in user comments. This works great to escape other HTML tags, but it still allows the user to improperly use the allowed tags in a way that screws up my markup. For example, someone can use an opening i tag and forget to close it. My markup will of course no longer validate. I don't know how the different browsers handle it, but at least on firefox, everything after the opening i tag will be italics.

How do I prevent user content that can contain a few whitelisted html tags from screwing up my markup?

Thanks!

2

You could always check if the markup is valid, and if not just escape all the html out of it.

Fred

3

On my website, I have a page that allows users to leave comments. I'm using Rick Olson's Whitelist plugin (http://svn.techno-weenie.net/ projects/plugins/white_list/) to only allow a, b and i tags in user comments. This works great to escape other HTML tags, but it still allows the user to improperly use the allowed tags in a way that screws up my markup. For example, someone can use an opening i tag and forget to close it. My markup will of course no longer validate. I don't know how the different browsers handle it, but at least on firefox, everything after the opening i tag will be italics.

How do I prevent user content that can contain a few whitelisted html tags from screwing up my markup?

You could always check if the markup is valid, and if not just escape all the html out of it.

Fred

Use Hpricot?

require 'rubygems'; gem 'hpricot'

=> true

require 'hpricot'

=> true

h = Hpricot("<b>bold<i>italic, too</b>")

=> #<Hpricot::Doc {elem <b> "bold" {elem <i> "italic, too"} </b>}>

h.to_html

=> "<b>bold<i>italic, too</i></b>"

Note that the closing </i> is added.

-Rob

Rob Biedenharn http://agileconsultingllc.com Rob@AgileConsultingLLC.com

4

Guys, thanks for your help. Hpricot worked like a charm. I had heard of hpricot before but had forgotten about it and never tried it.