javascript - Sanitizing CSS in Rails - Stack Overflow

admin管理员组

文章数量:1357716

I want to allow the users of a web app that I'm building to write their own CSS in order to customize their profile page.

However I am aware of this opening up for many security risks, i e background: url('javascript:alert("Got your cookies! " + document.cookies').

Hence I am looking for a solution to sanitize the CSS while still allowing as much CSS functionality as possible for my users.

So my questions if anyone anyone knows of a gem or a plugin to handles this? I've googled my brains out already so any tips would be really appreciated!

I want to allow the users of a web app that I'm building to write their own CSS in order to customize their profile page.

However I am aware of this opening up for many security risks, i e background: url('javascript:alert("Got your cookies! " + document.cookies').

Hence I am looking for a solution to sanitize the CSS while still allowing as much CSS functionality as possible for my users.

So my questions if anyone anyone knows of a gem or a plugin to handles this? I've googled my brains out already so any tips would be really appreciated!

• javascript
• ruby-on-rails
• css
• security

Share Improve this question Follow asked Jun 16, 2010 at 7:09 ErikErik 14111 silver badge33 bronze badges 3

• just curious, how are you storing your CSS? in database or as a file for each user? – Shripad Krishna Commented Jun 16, 2010 at 7:38
• Wow.. crazy that you can execute javascript from CSS like that. No idea how to solve it though - sorry! – zaius Commented Jun 16, 2010 at 7:48
• Shripad K: I'll store the CSS in the database. zaius: Yup! Check out this page: guides.rubyonrails/security.html#css-injection – Erik Commented Jun 16, 2010 at 7:55

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 7

Rails has a built-in css sanitizer

See http://apidock./rails/ActionView/Helpers/SanitizeHelper/sanitize_css and its parent http://apidock./rails/ActionView/Helpers/SanitizeHelper/sanitize

> ActionController::Base.helpers.sanitize_css('background:#fff')
=> "background: #fff;" 
> ActionController::Base.helpers.sanitize_css('javascript:alert("garr");')
=> "" 

There's also some code called css_file_sanitize: https://github./courtenay/css_file_sanitize

Comparing it to the Rails sanitize mand I find that both use regular expressions to strip out undesirable portions of the CSS.

Here's the source for css_file_sanitize: https://github./courtenay/css_file_sanitize/blob/master/lib/css_sanitize.rb

Here's the source for Rails sanitize: https://github./rails/rails/blob/master/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb

本文标签： javascriptSanitizing CSS in RailsStack Overflow