Module: XssTerminate::InstanceMethods

Defined in:
lib/xss_terminate.rb

Instance Method Summary collapse

Instance Method Details

#sanitize_fields ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'lib/xss_terminate.rb', line 29

def sanitize_fields
  # fix a bug with Rails internal AR::Base models that get loaded before
  # the plugin, like CGI::Sessions::ActiveRecordStore::Session
  return if xss_terminate_options.nil?

  self.class.columns.each do |column|
    next unless (column.type == :string || column.type == :text)

    field = column.name.to_sym
    value = self[field]

    next if value.nil? || !value.is_a?(String)

    if xss_terminate_options[:except].include?(field)
      next
    elsif xss_terminate_options[:html5lib_sanitize].include?(field)
      self[field] = HTML5libSanitize.new.sanitize_html(value)
    elsif xss_terminate_options[:sanitize].include?(field)
      self[field] = RailsSanitize.white_list_sanitizer.sanitize(value)
    else
      self[field] = RailsSanitize.full_sanitizer.sanitize(value)
    end
  end

end