开发者

Escape HTML in markdown in HAML

Is it possible, in Rails 3.1, to escape HTML in markdown in HAML to avoid XSS? I mean when you 开发者_开发知识库do something like:

:markdown
  Hello #{@user.name}

Thanks.


For now I created this:

module Haml::Filters::SafeMarkdown
  include Haml::Filters::Base
  lazy_require "rdiscount", "peg_markdown", "maruku", "bluecloth"

  def render(text)
    engine = case @required
               when "rdiscount"
                 ::RDiscount
               when "peg_markdown"
                 ::PEGMarkdown
               when "maruku"
                 ::Maruku
               when "bluecloth"
                 ::BlueCloth
             end
    engine.new(Haml::Helpers.html_escape(text)).to_html
  end
end

and to make it easy to use it directly:

module SafeMarkdown
  def self.render(text)
    Haml::Filters.defined["safemarkdown"].render(text).html_safe
  end
end

It seems to work for now. Does anybody have a comment?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜