Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:ruby-security/rails-avoid-raw
Language: Ruby
Severity: Info
Category: Security
Description
The raw method in Ruby on Rails is used to output unescaped strings of text directly to the HTML. This method can lead to Cross-Site Scripting (XSS) vulnerabilities if user input is passed into it, as it allows for the execution of malicious scripts.
XSS attacks can lead to a variety of security problems, such as data theft, website defacement, and distribution of malware to users. As such, it’s crucial to prevent these vulnerabilities in your code.
To avoid this, instead of using raw, consider using the html_safe method on strings that you know are safe, or the sanitize method on strings that may contain user input. Both of these methods will ensure that any potentially harmful scripts in the string are properly escaped before being output to the HTML. For example, instead of using raw(my_variable), you could use sanitize(my_variable).
