How does a rails view output contents between <%= > and <%== >

Question

In my rails application_helper.rb file, there is a parse method. Inside that method is a string variable html, which contains

<form>

, other html tags, and

&nbsp;

in its value. I will call parse inside my view index.html.erb, with

<%= parse() %>

The call to parse will output the value of the html variable.

Quite unexpectedly, I noticed that the view renders a webpage which the browser didn't process at all, i.e., the webpage contains the writing

<form>

instead of rendering a form; and so on for all the other tags, such as

<br>.

And

&nbsp;

was also not replaced by a corresponding space.

On checking the source code of the webpage, I noticed that all the ampersands(such as of

&nbsp;

) was sent by the view to the browser as

&amp;

and < was sent as

&lt;

and similiarly for >.

So, what did happen? Putting

<parse()>

inside

<%= %>

processed the value of html before handing it out to the browser? Why?

Another piece of the puzzle is, the webpage was rendered fine when I put parse() inside

<%== %>

(I know

<%== %>

is not a correct syntax, I just discovered this piece of puzzle about it by mistake.)

So what is going on?

AntonTkachov · Accepted Answer · 2017-11-23 10:07:21Z

2

<%= => Escapes all tags for security reasons. For instance I will put some script into my name: <script>...something bad to steal your accesses, cookies, make redirects, etc</script>. When you visit my profile, this script will be executed. This attack is called Cross Site Scripting (XSS). So rails cares about you and escape all such thing to prevent XSS attacks.

What you are looking for is to call your expression this way:

<%= raw(parse()) %>

OR it's alias, that you mentioned:

<%== parse() %>

More details -- http://edgeguides.rubyonrails.org/active_support_core_extensions.html#output-safety

This should keep all your tags without escaping.... but keep in mind... if you have any kind of data, that was input by the user in parse, then you will open an XSS vulnerability in your application. It's not something you should NEVER do. It's something that you should do only in case, when you know what you are doing ;)

answered Nov 23, 2017 at 10:07

AntonTkachov

1,7841 gold badge10 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tony Marshle Over a year ago

Then when we use the link_to, or image_tag helper functions inside <%= %> , why isn't the generated <a> tag or <img> tag escaped?

AntonTkachov Over a year ago

As I know, link_to uses content_tag in it's implementation and content_tag generates an html_safe string. One of the possible variants you could go with is <%= parse().html_safe %>. raw(parse()) is mostly like an alias to parse().to_s.html_safe

Collectives™ on Stack Overflow

How does a rails view output contents between <%= > and <%== >

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related