This rule is designed to ensure that HTML entities are escaped when they are included in JSON. Escaping HTML entities in JSON is important because it helps to prevent cross-site scripting (XSS) attacks. XSS attacks can allow attackers to inject malicious scripts into web pages viewed by other users, leading to a wide range of potential security issues.
The ActiveSupport.escape_html_entities_in_json configuration option in Ruby on Rails controls whether or not HTML entities are escaped in JSON. By default, this option is set to false. However, for better security, it should be set to true.
To avoid violating this rule, always set ActiveSupport.escape_html_entities_in_json = true in your Ruby on Rails applications. This will ensure that any HTML entities that are included in your JSON are properly escaped, helping to protect your application from potential XSS attacks.
Non-Compliant Code Examples
ActiveSupport.escape_html_entities_in_json=false
Compliant Code Examples
ActiveSupport.escape_html_entities_in_json=true
원활한 통합. Datadog Code Security를 경험해 보세요
Datadog Code Security
이 규칙을 사용해 Datadog Code Security로 코드를 분석하세요
규칙 사용 방법
1
2
rulesets:- ruby-security # Rules to enforce Ruby security.
리포지토리 루트에 위의 내용을 포함하는 static-analysis.datadog.yml을 만듭니다
무료 IDE 플러그인을 사용하거나 CI 파이프라인에 Code Security 검사를 추가합니다
