Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:ruby-security/rails-manual-template
Language: Ruby
Severity: Warning
Category: Security
Description
The rule ‘Avoid manual template creation’ is aimed at preventing the direct use of ‘ERB.new’ for creating new templates in Ruby. This is because manually creating templates can increase the risk of code injection attacks. An attacker could potentially inject malicious code into your templates, leading to significant security issues.
It’s important to adhere to this rule because it promotes better security practices. By avoiding manual template creation, you reduce the potential attack surface for malicious actors. Additionally, manually creating templates can lead to messy and hard-to-maintain code, which can negatively impact the overall quality of your application.
Instead of manually creating templates, consider using Rails’ built-in mechanisms for managing views and templates. For instance, you can use the ‘render’ method in your controller to render a view. Here’s an example: render 'template_name'. This method automatically handles the loading and processing of ERB templates, making your code safer and cleaner.
