Security Tools

rails_xss

337

275
16
This plugin replaces the default ERB template handlers with erubis, and switches the behaviour to escape by default rather than requiring you to escape. This is consistent with the behaviour in Rails 3.0. Last commit: Mon, 24 May 2010 22:03:50 +0000

gem install rails_xss

Downloads: 235

 v0.1.3
71

tarantula

311

291
11
A big hairy fuzzy spider that crawls your site, wreaking havoc Last commit: Fri, 15 Jan 2010 13:06:17 +0000

gem install tarantula

Downloads: 1703

 v0.3.3
1010

loofah

310

210
20
Loofah is a general library for manipulating HTML/XML documents and fragments. It's built on top of Nokogiri and libxml2, so it's fast and has a nice API. Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's whitelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.) Last commit: Wed, 21 Jul 2010 06:53:37 +0000

gem install loofah

Downloads: 9778

 v0.4.7
4010

xss_terminate

170

115
11
xss_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore. Last commit: Sun, 30 May 2010 02:24:41 +0000

find_mass_assignment

81

76
3
Find likely mass assignment vulnerabilities Last commit: Wed, 13 Jan 2010 21:10:55 +0000

param_protected

54

42
3
Provides two class methods on ActiveController::Base that filter the params hash for that controller's actions. You can think of them as the controller analog of attr_protected and attr_accessible. Last commit: Tue, 25 May 2010 17:01:58 +0000

gem install param_protected

Downloads: 317

 v1.3.0
79

audit_mass_assignment

4

7
0
Checks Ruby on Rails models for use of the attr_accessible white list. Last commit: Wed, 28 May 2008 08:03:26 +0000

cross_site_sniper

3

5
0
Ruby on Rails Plugin that automatically wraps html_escape() around ActiveRecord attribute methods associated with string and text fields in the database. Last commit: Wed, 18 Feb 2009 05:08:36 +0000