Use Rails’ APIs to Generate Markup
Explore how to safely generate HTML markup in Rails views using built-in helper methods such as content_tag. Understand the risks of manual string interpolation and the importance of escaping untrusted content to protect against injection attacks and security vulnerabilities in web applications.
We'll cover the following...
Issues with the current view
The view is a magnet for security issues because it’s code that gets executed in the user’s browser and not on our servers. The OWASP Top Ten is a list of the ten most problematic security risks for a web application. Several of these vulnerabilities can be exploited by allowing unsafe content to be sent to a user’s browser in HTML, CSS, or JavaScript.
When we just use HTML templates, Rails does a great job of preventing these problems. If a user creates a Widget named <strong>HACKED</strong> Stembolts, Rails would escape those <strong> tags so the browser doesn’t render them.