# Sanitize dangers

**URL:** <https://www.ruby-forum.com/t/sanitize-dangers/60209>\
**Category:** Rails\
**Created:** [May 11, 2006, 5:05am UTC](https://www.ruby-forum.com/t/sanitize-dangers/60209 "2006-05-11T05:05:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Baudanza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@Jonathan\_Baudanza](https://www.ruby-forum.com/u/Jonathan_Baudanza)\
**Post date:** [May 11, 2006, 5:05am UTC](https://www.ruby-forum.com/t/sanitize-dangers/60209/1 "2006-05-11T05:05:40Z")

</div>

I’ve noticed that it is possible to pass javascript unaltered through  
the sanitize function using CSS. For example:

sanitize( “body{background-image:url(‘javascript:window.alert(1)’)  
}” )

IE will execute the javascript. Firefox will not. I haven’t tried it  
with any other browsers.

This isn’t really a bug, since the documentation for sanitize doesn’t  
claim to clean up CSS. The docs should perhaps contain a disclaimer  
that sanitize alone is not sufficient for removing javascript and  
preventing XSS attacks.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Baudanza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@Jonathan\_Baudanza](https://www.ruby-forum.com/u/Jonathan_Baudanza)\
**Post date:** [May 11, 2006, 9:54pm UTC](https://www.ruby-forum.com/t/sanitize-dangers/60209/2 "2006-05-11T21:54:10Z")

</div>

Jonathan Baudanza wrote:

> I’ve noticed that it is possible to pass javascript unaltered through  
> [SNIP]  
> This isn’t really a bug, since the documentation for sanitize doesn’t  
> claim to clean up CSS. The docs should perhaps contain a disclaimer  
> that sanitize alone is not sufficient for removing javascript and  
> preventing XSS attacks.

I’d call this a bug seeing that sanitize ensures “that arbitrary  
Javascript cannot be executed” and suggest you file a bug report in trac

- and ofcourse a nice test-based patch 🙂

---

<div class="post-metadata">

**Author:** ![Jonathan\_Baudanza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@Jonathan\_Baudanza](https://www.ruby-forum.com/u/Jonathan_Baudanza)\
**Post date:** [May 11, 2006, 11:07pm UTC](https://www.ruby-forum.com/t/sanitize-dangers/60209/3 "2006-05-11T23:07:00Z")

</div>

Jonathan, will you let us know if you’re going to send the ticket in ?  
Just want to make sure this one doesn’t slip through the cracks 🙂

---

<div class="post-metadata">

**Author:** ![Jonathan\_Baudanza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@Jonathan\_Baudanza](https://www.ruby-forum.com/u/Jonathan_Baudanza)\
**Post date:** [May 12, 2006, 12:24am UTC](https://www.ruby-forum.com/t/sanitize-dangers/60209/4 "2006-05-12T00:24:25Z")

</div>

Dylan S. wrote:

> Jonathan, will you let us know if you’re going to send the ticket in ?  
> Just want to make sure this one doesn’t slip through the cracks 🙂

[http://dev.rubyonrails.org/ticket/4154](http://dev.rubyonrails.org/ticket/4154)

Looks like it’s already being tracked. I think what is really needed is  
a sanitize\_css method that sanitize can use to clean tags and  
style= attributes.