# Strip & Sanitize BEFORE saving data **URL:** \ **Category:** Rails\ **Created:** [November 29, 2007, 2:51am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583 "2007-11-29T02:51:51Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [December 14, 2007, 12:10am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/21 "2007-12-14T00:10:42Z")
On Dec 13, 2007, at 9:34 AM, Mark W. wrote: > My problem with sanitization is that it puts representational logic in > the model. And embedding HTML in the data doesn’t? If it’s representational to remove it, then it’s representational to allow it, no? > Should the model really care that its data might one day > appear on an HTML page? Or should the HTML page take care of its own > needs? IMO, both. At the goes-inta stage, sanitization is nothing more than a particular type of validation. As a parallel, I don’t want phone numbers to be formatted, yet I allow users to enter formatting, and then strip it out before I store the data. I’m not going to keep the myriad formats of entered values, and the deal with removing it over & over again as the data is used or displayed. The model should take care of itself here. I don’t buy the argument at all that users “may” need a certain HTML tag. Setting aside the simplistic and narrow view of the world from the perspective of the ubiquitous blog, HTML has no business in the fields that make up a real, data-centric, application. Removing all traces of it from such fields is an input validation issue that the model should be taking care of before the data even get into the model IMO (not after it is loaded into the model the way Rails currently works). Not stripping code before it reaches the model based on an academic or philosophical point ignores the real-world danger of that stuff, and the greater responsibility to take every opportunity to protect those who use my aplication by taking every chance I can get to ensure the data is not infected. Personally, for fields that may require stylizing, I prefer an alternative form of markup that provides greater control over what is allowed. If there simply is no other option but raw HTML, then such cases can be handled as exceptions, not as rules which endanger the greater balance of the data. Having done all that, one can end up with a false sense of, err, security, by assuming that data coming from the database can be trusted. Remember your X-Files lessons, and Trust No One. You never know who, or what might have direct access to the database. Data imports, mergers, restored backups from before data was cleaned. Even that trusted admin with direct db access that you’ve paid to go to all those security conferences may decide there really is easy money to made by sneaking some code into the data. So, for these and similar reasons (alternative uncontrolled data sources like RSS vs DB for news stories), of course the HTML page should take care of itself too with proper filters applied at the goes-outta stage. So, yeah, I say sanitization needs to be done at both ends, and debating whether it should be done at one end or the other is like debating whether we should vaccinate for tuberculosis and ignore the disease if it shows up vs. ignoring the opportunity to vaccinate because we can just treat someone if they get it. We need to do both: vaccinate for prevention, and treat for containment. – def gw acts\_as\_n00b writes\_at(www.railsdev.ws) end ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [December 14, 2007, 10:44pm UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/22 "2007-12-14T22:44:38Z")
On Dec 14, 2007, at 10:46 AM, Mark W. wrote: > I know we’re not going to agree on this, of course. I’m not exactly a > belt-and-suspenders kind of guy. 🙂 Based on your business rule descriptions, a hashed out live conversation would likely reveal me agreeing to the principle you’re positing. However, for practical purposes, I see these two descriptions ending up as the same thing. I know they’re not the same, but where the rubber hits the road, I think the second rule _usually_ (not always of course) turns into the first rule because being “not vulnerable” usually turns into “don’t even allow it” when you realize the app don’t need it, which pushes me to say that by default, sanitizing should happen on the goes\_inta side _except_ where html is valid content. I don’t see it as suspenders, but rather as an aggressive way to acheive both the first and second rule at the same time. So, even if you beat me into agreeing with you fully, I’m quite sure I would leave the room and still sanitize HTML at the model because I think the first rule is the one that should apply everywhere except where it’s obvious that it cannot. Good discussion to understand the distinctions though. Thx. – def gw acts\_as\_n00b writes\_at(www.railsdev.ws) end ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [January 7, 2008, 3:37am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/23 "2008-01-07T03:37:44Z")
Marston A. wrote: > There have also been some new plugins that have come out in the last > few weeks: > > [http://code.al3x.net/svn/acts\_as\_sanitized/](http://code.al3x.net/svn/acts_as_sanitized/) > [http://code.google.com/p/sanitizeparams/](http://code.google.com/p/sanitizeparams/) Looks to me like acts\_as\_sanitized has moved to [http://svn.devjavu.com/actsassanitized](http://svn.devjavu.com/actsassanitized) with a project page at [http://actsassanitized.devjavu.com/](http://actsassanitized.devjavu.com/). It didn’t work with Rails 2.0.2 out of the box, so I tried a little tinkering by replacing this: include ActionView::Helpers::TextHelper with include ActionView::Helpers::SanitizeHelper I get a “undefined method `white\_list\_sanitizer’ for #Class:0x248a8bc” error. I’ve tried a number of other, but no luck. How would you update this for Rails 2.0? cheers, Walter ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [September 4, 2008, 11:11am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/24 "2008-09-04T11:11:43Z")
Walter Mcginnis wrote: > Walter Mcginnis wrote: > > > It didn’t work with Rails 2.0.2 out of the box, so I tried a little > > tinkering by replacing this: > > > > include ActionView::Helpers::TextHelper > > > > with > > > > include ActionView::Helpers::SanitizeHelper > > > > I get a “undefined method `white\_list\_sanitizer’ for #Class:0x248a8bc” > > error. > > Nevermind, got it working. Will submit to plugin maintainer… > > Cheers, > Walter I run into this similar error: ActionView::TemplateError (undefined method `white\_list\_sanitizer’ for TextHelperSingleton:Class) How did you fix that? I used this: [http://www.csummers.org/2006/08/07/extend-string-to-use-actionviews-text-helpers/](http://www.csummers.org/2006/08/07/extend-string-to-use-actionviews-text-helpers/) Thanks, Isaiah p. ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [January 9, 2008, 3:54am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/25 "2008-01-09T03:54:26Z")
Walter Mcginnis wrote: > It didn’t work with Rails 2.0.2 out of the box, so I tried a little > tinkering by replacing this: > > include ActionView::Helpers::TextHelper > > with > > include ActionView::Helpers::SanitizeHelper > > I get a “undefined method `white\_list\_sanitizer’ for #Class:0x248a8bc” > error. Nevermind, got it working. Will submit to plugin maintainer… Cheers, Walter ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [September 4, 2008, 9:25pm UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/26 "2008-09-04T21:25:10Z")
Isaiah Peng wrote: > Walter Mcginnis wrote: > > > Walter Mcginnis wrote: > > Nevermind, got it working. Will submit to plugin maintainer… > > > > Cheers, > > Walter > > I run into this similar error: > ActionView::TemplateError (undefined method `white\_list\_sanitizer’ for > TextHelperSingleton:Class) > How did you fix that? > I used this: > [http://www.csummers.org/2006/08/07/extend-string-to-use-actionviews-text-helpers/](http://www.csummers.org/2006/08/07/extend-string-to-use-actionviews-text-helpers/) > > Thanks, > Isaiah p. I never heard anything back from the plugin maintainer, so I left my customizations “on top” of the plugin in my use of it. They can be seen at [http://github.com/kete/kete/tree/master/vendor/plugins/acts\_as\_sanitized](http://github.com/kete/kete/tree/master/vendor/plugins/acts_as_sanitized) Cheers, Walter ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [January 1, 2009, 1:08pm UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/27 "2009-01-01T13:08:46Z")
> I never heard anything back from the plugin maintainer, so I left my > customizations “on top” of the plugin in my use of it. They can be seen > at > [http://github.com/kete/kete/tree/master/vendor/plugins/acts\_as\_sanitized](http://github.com/kete/kete/tree/master/vendor/plugins/acts_as_sanitized) > > Cheers, > Walter What are all the plugins available for sanitizing user input and that work with Rails 2.2.2? ---
**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\ **Post date:** [January 2, 2009, 12:22am UTC](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583/28 "2009-01-02T00:22:15Z")
Fernando P. wrote: > What are all the plugins available for sanitizing user input and that > work with Rails 2.2.2? You may want to checkout the new Sanitize gem. I just read about it here: [http://www.rubyinside.com/how-to-sanitize-html-and-css-in-ruby-1429.html](http://www.rubyinside.com/how-to-sanitize-html-and-css-in-ruby-1429.html) As far as Rails I haven’t updated to the latest version yet, so no idea if my version of the plugin still works. Cheers, Walter [Previous page](https://www.ruby-forum.com/t/strip-sanitize-before-saving-data/121583.md?page=1)