Escape HTML in markdown in HAML
Is it possible, in Rails 3.1, to escape HTML in markdown in HAML to avoid XSS? I mean when you 开发者_开发知识库do something like:
:markdown
Hello #{@user.name}
Thanks.
For now I created this:
module Haml::Filters::SafeMarkdown
include Haml::Filters::Base
lazy_require "rdiscount", "peg_markdown", "maruku", "bluecloth"
def render(text)
engine = case @required
when "rdiscount"
::RDiscount
when "peg_markdown"
::PEGMarkdown
when "maruku"
::Maruku
when "bluecloth"
::BlueCloth
end
engine.new(Haml::Helpers.html_escape(text)).to_html
end
end
and to make it easy to use it directly:
module SafeMarkdown
def self.render(text)
Haml::Filters.defined["safemarkdown"].render(text).html_safe
end
end
It seems to work for now. Does anybody have a comment?
精彩评论