Class: Rack::Protection::EscapedParams

### Home Classes Methods

### In Files

- lib/rack/protection/escaped_params.rb

### Parent

Rack::Protection::Base

### Methods

- ::new
- #call
- #escape
- #escape_hash
- #escape_string
- #handle

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::EscapedParams

Prevented attack | XSS
Supported browsers | all
More infos | en.wikipedia.org/wiki/Cross-site_scripting

Automatically escapes Rack::Request#params so they can be embedded in HTML or JavaScript without any further issues. Calls `html_safe` on the escaped strings if defined, to avoid double-escaping in Rails.

Options:

escape | What escaping modes to use, should be Symbol or Array of Symbols. Available: :html (default), :javascript, :url

### Public Class Methods

new(*) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 34
    def initialize(*)
      super

      modes       = Array options[:escape]
      @escaper    = options[:escaper]
      @html       = modes.include? :html
      @javascript = modes.include? :javascript
      @url        = modes.include? :url

      if @javascript and not @escaper.respond_to? :escape_javascript
        fail("Use EscapeUtils for JavaScript escaping.")
      end
    end

### Public Instance Methods

call(env) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 48
    def call(env)
      request  = Request.new(env)
      get_was  = handle(request.GET)
      post_was = handle(request.POST) rescue nil
      app.call env
    ensure
      request.GET.replace  get_was  if get_was
      request.POST.replace post_was if post_was
    end

escape(object) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 64
    def escape(object)
      case object
      when Hash   then escape_hash(object)
      when Array  then object.map { |o| escape(o) }
      when String then escape_string(object)
      else nil
      end
    end

escape_hash(hash) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 73
    def escape_hash(hash)
      hash = hash.dup
      hash.each { |k,v| hash[k] = escape(v) }
      hash
    end

escape_string(str) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 79
    def escape_string(str)
      str = @escaper.escape_url(str)        if @url
      str = @escaper.escape_html(str)       if @html
      str = @escaper.escape_javascript(str) if @javascript
      str
    end

handle(hash) click to toggle source

    # File lib/rack/protection/escaped_params.rb, line 58
    def handle(hash)
      was = hash.dup
      hash.replace escape(hash)
      was
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.