Rails sanitize and Data URI scheme

[Shlomi Zadok]

Hi,
I am saving a Data URI scheme (<img src="data:image/
png;base64,iVBORw0K.... " width="250" />), in my content
When showing the content I parse it via sanitize,
like this: <%=sanitize @content.body, :attributes => %w(id class
style) %>
The <img> tag is shown but without the data:image/png...
Any ideas how I can bypass the sanitize rule?

Thanks,
Shlomi.

[Vitaly Kushner]

My first reaction was RTFM at http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize
;)

then I took a closer look.

src is already in allowed_attributes, so the problem is elsewhere.
After some digging I came up with this:

HTML::WhiteListSanitizer.allowed_protocols << 'data'

After that it will work. it adds data to the list of protocols allowed
inside uri_attributes.

[Shlomi Zadok]

Vitaly,
Thanks.
I am a newbie - where do I put the
"HTML::WhiteListSanitizer.allowed_protocols << 'data'" ?
I have tried to put it in application.rb and it didn't help
Also tried to add: "config.action_view.sanitized_allowed_protocols =
'data'"
Which also didn't work




On Jun 26, 11:23 am, Vitaly Kushner <vita...@gmail.com> wrote:
> My first reaction was RTFM athttp://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize

[Vitaly Kushner]

On Jun 26, 2:19 pm, Shlomi Zadok <shl...@ben-hanna.com> wrote:
> Vitaly,
> Thanks.
> I am a newbie - where do I put the
> "HTML::WhiteListSanitizer.allowed_protocols << 'data'" ?
> I have tried to put it in application.rb and it didn't help
> Also tried to add:  "config.action_view.sanitized_allowed_protocols =
> 'data'"
> Which also didn't work

indeed, as Rails people didn't anticipate the need ;)

try config/initializers/sanitizer.rb

[Shlomi Zadok]

Tried config/initializers/sanitizer.rb: Didnt work.. :(

[Vitaly Kushner]

I don't know. Works for me:

caramel ➜ ~/tmp ✗ rails new foo
create
create README
create Rakefile
create config.ru

....

create tmp/cache
create tmp/pids
create vendor/plugins
create vendor/plugins/.gitkeep
caramel ➜ ~/tmp ✗ cd foo
caramel ➜ ~/tmp/foo ✗ cat > config/initializers/sanitizer.rb
HTML::WhiteListSanitizer.allowed_protocols << 'data'
caramel ➜ ~/tmp/foo ✗ rails c
Loading development environment (Rails 3.0.7)
ruby-1.8.7-p302 :001 > helper.sanitize "<img src='data:foo'/>"
=> "<img src=\"data:foo\" />"
ruby-1.8.7-p302 :002 >

[Shlomi Zadok]

ok, so that's completely wierd...
It also works for me on the rails console
yet still not working on the show.html.erb (<%=sanitize

@content.body, :attributes => %w(id class

style) %> )....

[Shlomi Zadok]

Vitaly,
It works...
But only when I remove from the sanitize the attributes (, :attributes
=> %w(id class style) )....
So I also removed them to the sanitizer.rb

and everything works like magic!

Thank you!

[Vitaly Kushner]

Well, duh!
you only had id class and style in the attributes, no wonder it
filtered out 'src' ;)
--
Vitaly Kushner
http://twitter.com/vkushner
Founder, Astrails Ltd. http://astrails.com/
Check out our blog: http://blog.astrails.com/

> --
> You received this message because you are subscribed to the Google Groups "Israel.rb - the Israel Ruby & Israel Rails Developers group" group.
> To post to this group, send email to isra...@googlegroups.com.
> To unsubscribe from this group, send email to israelrb+u...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/israelrb?hl=en.
>
>

[Elad Meidar]

Hi Shlomi,

There's also a group for ruby on rails in israel on Facebook if you are interested, there are some peeps who hang out there and aren't here.

Fiverr.com