Skip to content

Commit 8d015df

Browse files
authored
Remove mention of deprecated SafeERB gem from security docs for now, prior section already speaks about sanitization as a safety measure. [ci skip] (rails#27086)
Fixes rails#27085
1 parent a48740d commit 8d015df

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

guides/source/security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -762,7 +762,7 @@ s = sanitize(user_input, tags: tags, attributes: %w(href title))
762762

763763
This allows only the given tags and does a good job, even against all kinds of tricks and malformed tags.
764764

765-
As a second step, _it is good practice to escape all output of the application_, especially when re-displaying user input, which hasn't been input-filtered (as in the search form example earlier on). _Use `escapeHTML()` (or its alias `h()`) method_ to replace the HTML input characters &, ", <, and > by their uninterpreted representations in HTML (`&`, `"`, `<`, and `>`). However, it can easily happen that the programmer forgets to use it, so _it is recommended to use the SafeErb gem. SafeErb reminds you to escape strings from external sources.
765+
As a second step, _it is good practice to escape all output of the application_, especially when re-displaying user input, which hasn't been input-filtered (as in the search form example earlier on). _Use `escapeHTML()` (or its alias `h()`) method_ to replace the HTML input characters &, ", <, and > by their uninterpreted representations in HTML (`&`, `"`, `<`, and `>`).
766766

767767
##### Obfuscation and Encoding Injection
768768

0 commit comments

Comments
 (0)