# Using taint/untait for security **URL:** \ **Category:** Rails\ **Created:** [September 23, 2008, 12:36pm UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301 "2008-09-23T12:36:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\ **Post date:** [September 23, 2008, 12:36pm UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301/1 "2008-09-23T12:36:59Z")
I thought to use the taint/untaint mechanisme included with ruby to enhance security in zena. I have read that using taint is not that good for the following reasons: - It’s not working on certain implementations of ruby (JRuby, IronRuby, …) - It’s a lot of work to make work (lots of tiny taint management code everywhere) I think I will just abandon this “taint” idea and continue writing careful code and tests. What do you think ? Gaspard * * * project: zena CMS ([http://zenadmin.org](http://zenadmin.org)) ---
**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\ **Post date:** [September 23, 2008, 1:31pm UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301/2 "2008-09-23T13:31:41Z")
Gaspard B. a écrit, le 09/23/2008 12:36 PM : > careful code and tests. > > What do you think ? safe\_erb uses tainted? to make sure you properly sanitize the various inputs of your application. You might want to look at it. I prefer to use it during development and tests to raise exceptions and disable it in production to avoid any performance penalty or unwanted errors (which would mean tests are missing, but I prefer rcov to user error reports helping me get good test coverage 🙂 ). Just google for it. Lionel ---
**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\ **Post date:** [September 24, 2008, 10:12am UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301/3 "2008-09-24T10:12:02Z")
Le 23 sept. 08 à 13:30, Lionel B. a écrit : > > I think I will just abandon this “taint” idea and continue writing > > careful code and tests. > > > > What do you think ? > > safe\_erb uses tainted? to make sure you properly sanitize the various > inputs of your application. You might want to look at it. > safe\_erb is a nice idea, but it still means you have to untaint each > time you do a sanity check like > return parser\_error(“invalid name #{name.inspect}”) unless name =~ / > ^[a-zA-Z\_]$/ > name.untaint # \<\<\< line to add > … You cannot remove these lines (with some kind of conditional compilation) in production mode, and you still have to write them… I’m not sure if it’s worth the effort and performance impact… Hmmm… ---
**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\ **Post date:** [September 24, 2008, 11:18am UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301/4 "2008-09-24T11:18:25Z")
Gaspard B. a écrit, le 09/24/2008 10:11 AM : > > > IronRuby, …) > > > inputs of your application. You might want to look at it. > > safe\_erb is a nice idea, but it still means you have to untaint each > time you do a sanity check like > return parser\_error(“invalid name #{name.inspect}”) unless name =~ / > ^[a-zA-Z\_]$/ > name.untaint # \<\<\< line to add Yes nothing is free. > … > > You cannot remove these lines (with some kind of conditional > compilation) Compilation ? What you do is simply redefine your sanitizing method (that you should already have by the way) to untaint in dev mode, no more no less. safe\_erb does it for html\_escape, escape\_once and strip\_tags for example. In production there’s zero impact : you original sanitizing methods run unmodified and you don’t even have to put safe\_erb in vendor/plugins there. This is how it works for us. Lionel ---
**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\ **Post date:** [September 24, 2008, 5:02pm UTC](https://www.ruby-forum.com/t/using-taint-untait-for-security/149301/5 "2008-09-24T17:02:17Z")
> > … > > In production there’s zero impact : you original sanitizing methods > > run > > unmodified and you don’t even have to put safe\_erb in vendor/plugins > > there. > > This is how it works for us. Ok, you solved the “conditional compilation” problem by wrapping all cleanup code in some generic methods that you redefine. It makes sense. Thanks. Gaspard