# Rich text aera?

**URL:** <https://www.ruby-forum.com/t/rich-text-aera/94340>\
**Category:** Rails\
**Created:** [April 30, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340 "2006-04-30T22:21:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [April 30, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/1 "2006-04-30T22:21:51Z")

</div>

Hi all,

I am trying to add an article editing interface to my future webstore,  
and I am wondering what to use for text formatting.

I would like to avoid using HTML, and calibre-bbcode just won’t work  
(see my last post).

Is there some kind of library for live text formatting right in the  
browser? I would just need bold, italics, size and ul lists… Do you  
know of a good solution?

Thank you very much  
Nauhaie

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [April 30, 2006, 10:44pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/2 "2006-04-30T22:44:06Z")

</div>

In fact, what I would like is a ROR equivalent for  
[http://www.kevinroth.com/rte/demo.php](http://www.kevinroth.com/rte/demo.php)

Thank you!  
Nauhaie

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [April 30, 2006, 10:57pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/3 "2006-04-30T22:57:54Z")

</div>

User TinyMCE.

I’ve implemented it with a helper function in most of my applications:

1. Download TinyMCE from the the website and stick the .js files in the  
javascript directoy.
2. Include this in your application\_helper.rb

# 

# TinyMCE Helpers

# 

def javascript\_include\_tinymce  
javascript\_include\_tag “tiny\_mce/tiny\_mce”  
end  
def include\_tiny\_mce

```
"#{javascript_include_tinymce}"+
 '<script language="javascript" type="text/javascript">
  tinyMCE.init({
    mode : "textareas",
    theme : "advanced",
        plugins : 

```

“advhr,advimage,advlink,preview,searchreplace,print”,  
theme\_advanced\_buttons2\_add :  
"separator,insertdate,inserttime,prev  
theme\_advanced\_buttons3\_add\_before :  
“tablecontrols,separator”,  
theme\_advanced\_toolbar\_location : “top”,  
theme\_advanced\_toolbar\_align : “left”,  
theme\_advanced\_path\_location : “bottom”,  
plugin\_insertdate\_dateFormat : “%Y-%m-%d”,  
plugin\_insertdate\_timeFormat : “%H:%M:%S”,  
extended\_valid\_elements :  
"a[name|href|target|title|onclick],img[cl  
external\_link\_list\_url :  
“example\_data/example\_link\_list.js”,  
external\_image\_list\_url :  
“example\_data/example\_image\_list.js”,  
flash\_external\_list\_url :  
“example\_data/example\_flash\_list.js”  
});  
’  
end  
3) Use “include\_tiny\_mce” function in your .rhtml file, and bam.

You can change the functionallity on the TinyMCE by changing  
“theme\_advanced” properties in the helper above.

Chris

Nauhaie wrote:

> In fact, what I would like is a ROR equivalent for  
> [http://www.kevinroth.com/rte/demo.php](http://www.kevinroth.com/rte/demo.php)
> 
> Thank you!  
> Nauhaie

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [May 1, 2006, 12:33am UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/4 "2006-05-01T00:33:40Z")

</div>

It’s your application’s job to ensure form data is sanitized before  
anything important is done with it. Even if TinyMCE or something like it  
returned scrubbed HTML, it can’t do anything to stop a malicious user  
from bypassing your form and passing bad data to your app.

This is not a Rails thing. It’s a basic rule of web development.

Nauhaie wrote:

> Wow, that’s cool!
> 
> I am going to use this I think! Thanks a lot!
> 
> One more question: is tinyMCE safe for letting users post comments? I  
> mean, is the output correctly cleared of cross-site-scripting  
> vulnerabilities?
> 
> Nauhaie

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [April 30, 2006, 11:28pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/5 "2006-04-30T23:28:07Z")

</div>

Wow, that’s cool!

I am going to use this I think! Thanks a lot!

One more question: is tinyMCE safe for letting users post comments? I  
mean, is the output correctly cleared of cross-site-scripting  
vulnerabilities?

Nauhaie

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [May 1, 2006, 7:09am UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/6 "2006-05-01T07:09:02Z")

</div>

Steve K. wrote:

> It’s your application’s job to ensure form data is sanitized before  
> anything important is done with it. Even if TinyMCE or something like it  
> returned scrubbed HTML, it can’t do anything to stop a malicious user  
> from bypassing your form and passing bad data to your app.

So, correct me if I am wrong: for it is almost impossible to sanitize  
HTML, I think I had better use Textile or Markdown for user reviews, and  
restrict TinyMCE for the body of the articles (modified by trusted  
admins)…

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [May 1, 2006, 12:55pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/7 "2006-05-01T12:55:30Z")

</div>

Textile and Markdown pertain to output. TinyMCE is an inline editor that  
pertains to input. In general, it is no more or less safe than a regular  
textarea. Use whatever you want, but just make sure that when you output  
user-supplied HTML to the browser that it has been cleaned at some  
point. Look at the sanitize() method in Rails.

Plenty of web applications use inline WYSIWYG HTML editors safely. You  
just have to make sure that yours does, too.

Nauhaie wrote:

> Steve K. wrote:
> 
> > It’s your application’s job to ensure form data is sanitized before  
> > anything important is done with it. Even if TinyMCE or something like it  
> > returned scrubbed HTML, it can’t do anything to stop a malicious user  
> > from bypassing your form and passing bad data to your app.
> 
> So, correct me if I am wrong: for it is almost impossible to sanitize  
> HTML, I think I had better use Textile or Markdown for user reviews, and  
> restrict TinyMCE for the body of the articles (modified by trusted  
> admins)…
> 
> Thank you for your help!

---

<div class="post-metadata">

**Author:** ![nauhaie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3ab097/32.png) [@nauhaie](https://www.ruby-forum.com/u/nauhaie)\
**Post date:** [May 3, 2006, 6:57pm UTC](https://www.ruby-forum.com/t/rich-text-aera/94340/8 "2006-05-03T18:57:10Z")

</div>

rails do have a sanitize(html) helper which “should” do the trick … i  
haven’t used it but if it works as advertized you could just use that to  
sanitize anything comming from untrusted users.

see  
[http://rubyonrails.com/rails/classes/ActionView/Helpers/TextHelper.html#M000516](http://rubyonrails.com/rails/classes/ActionView/Helpers/TextHelper.html#M000516)