plans for insecure text helpers

rubyonrails-core
1

Hi!

What are the plans for the insecure text helpers strip_tags, strip_links and sanitize? See also http://dev.rubyonrails.org/ticket/8877 ? The white_list plugin does a good job removing tags on a whitelist basis, it could be included in the core. Here is a first version of more secure text helpers, using the white_list plugin. Do I have to make it a plugin or is there a chance for the core?

module SecureHelper

  include WhiteListHelper

  # TODO sanitize

2

What are the plans for the insecure text helpers strip_tags, strip_links and sanitize? See also http://dev.rubyonrails.org/ticket/8877 ? The white_list plugin does a good job removing tags on a whitelist basis, it could be included in the core.

I think the best bet for rails 2.0 is to include rick's whitelist plugin, and make sanitize call that internally with a sensible default set of tags. Strip links could similarly be adapted.

Rick, care to whip something up :slight_smile: