Prevented attack |
XSS |
Supported browsers |
all |
More infos |
Automatically escapes Rack::Request#params so they can be embedded in HTML or JavaScript without any further issues. Calls html_safe on the escaped strings if defined, to avoid double-escaping in Rails.
Options:
escape |
What escaping modes to use, should be Symbol or Array of Symbols. Available: :html (default), :javascript, :url |
# File lib/rack/protection/escaped_params.rb, line 34 def initialize(*) super modes = Array options[:escape] @escaper = options[:escaper] @html = modes.include? :html @javascript = modes.include? :javascript @url = modes.include? :url if @javascript and not @escaper.respond_to? :escape_javascript fail("Use EscapeUtils for JavaScript escaping.") end end
# File lib/rack/protection/escaped_params.rb, line 48 def call(env) request = Request.new(env) get_was = handle(request.GET) post_was = handle(request.POST) rescue nil app.call env ensure request.GET.replace get_was if get_was request.POST.replace post_was if post_was end
# File lib/rack/protection/escaped_params.rb, line 64 def escape(object) case object when Hash then escape_hash(object) when Array then object.map { |o| escape(o) } when String then escape_string(object) else nil end end
# File lib/rack/protection/escaped_params.rb, line 73 def escape_hash(hash) hash = hash.dup hash.each { |k,v| hash[k] = escape(v) } hash end
Generated with the Darkfish Rdoc Generator 2.