# \[ANN\] Cross Site Sniper 0.2 (stable) **URL:** \ **Category:** Rails\ **Created:** [January 31, 2008, 7:11pm UTC](https://www.ruby-forum.com/t/ann-cross-site-sniper-0-2-stable/127720 "2008-01-31T19:11:11Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![jonlog](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/db5fbb/32.png) [@jonlog](https://www.ruby-forum.com/u/jonlog)\ **Post date:** [January 31, 2008, 7:11pm UTC](https://www.ruby-forum.com/t/ann-cross-site-sniper-0-2-stable/127720/1 "2008-01-31T19:11:11Z")
I’m pleased to announce the release of Cross Site Sniper 0.2. Cross Site Sniper is one more addition to the ever growing list of tools that attempt to provide a convenient and DRY method to protect Rails sites from Cross Site Scripting (XSS) attacks. There are many plugins and tools out there that attempt to address this issue, but none of them met my requirements. So, I created Cross Site Sniper, a Ruby on Rails plugin that automatically wraps html\_escape() around ActiveRecord attribute methods associated with string and text fields in the database. Features… - All ActiveRecord classes have their dynamically generated accessor methods associated with String and Text fields automatically escaped. So, no matter if you’re calling the method from a view, a helper, or within a controller as part of a RJS response, you don’t need to remember to wrap it in h(), because it’s already escaped. - Form fields on edit forms prepopulate with _un_escaped data Users edit exactly what they originally submitted, without special characters disappearing or unexpectedly morphing into strings of other characters. - Easy one-time access to unescaped data when you need it. eg: @person.name\_without\_html\_escaping - A convenience method for class definitions is available to fine tune which string and text fields get escaped automatically. - Original unescaped text is stored in the database and escaped on output This allows for unescaped data to be accessed more conveniently when necessary, and improved scrubbing techniques to be instantly applied to legacy data simply by upgrading or swapping out the plugin with another. ( Some xss plugins choose to escape the data on input, a philosophy I don’t personally agree with but some people do, so I thought it was important to explicitly mention this feature here so people could make informed decisions. ) Documentation and Installation instructions are at [http://xss.rubyforge.org/](http://xss.rubyforge.org/) Feed back and suggestions are welcome and encouraged. Big thanks to my employer ( [www.wwidea.org](http://www.wwidea.org) ) for allowing this code to be released to the community under the MIT License. – [http://www.5valleys.com/](http://www.5valleys.com/) [http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)