Professional Ruby on Rails™

8.4. Cross-Site Scripting Security

Most of this chapter has been spent discussing how to generate JavaScript from Rails. This section is about preventing JavaScript from being generated — or more specifically, how to prevent a malicious user from injecting JavaScript into a client page pointed at your system and carrying out a cross-site scripting (XSS) attack.

The basic idea behind an XSS exploit is that unintended JavaScript injected on to a browser page in your system can cause sensitive information to be retrieved from the server and displayed in the client's browser. For example, an XSS exploit might occur if JavaScript is inserted into a recipe description or tag list on the Soups OnLine site, or is inserted in a forum comment of some kind on other sites.

Although many of these exploits are only fully dangerous when combined with some kind of phishing scam (where an unsuspecting user is tricked into injecting the malicious code), you should try to avoid any openings by which cross-site code can be sent to your server.

The basic mechanism for preventing XSS attacks is to aggressively verify and scrub any data that comes in from a user and will eventually be displayed on the screen (or sent to the database — user-generated SQL can also wreak havoc on your system). Information with a known format should be validated against that format. This is relatively easy for numerical data, and a lot of text data (such as names) can be scrubbed to include only alphabetical or alphanumeric ...