Project

disinfect_url

0.0
No release in over a year
disinfect_urlstevenjcumming/disinfect_urlHomepageDocumentationSource CodeBug Tracker
A gem to sanitize URLs or HTML href attributes within <a> tags to help prevent XSS attacks.
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Popularity
Downloads
494
Stars
1
Forks
0
Watchers
1
 Releases
Current version
0.2.0
Total releases
1
First release
2023-07-04
Latest release
2023-07-04
 Development
Primary Language
Ruby
Licenses
MIT
Average date of last 50 commits
2023-07-04
Reverse Dependencies
0

 Dependencies

Development

bundler
~> 2.0
rspec
~> 3.0
rubocop
~> 1.21
rubocop-rspec
~> 2.22
yard
~> 0.9.34

Runtime

nokogiri
~> 1.11
 Project Readme

DisinfectUrl

Gem Version

This gem was heavily influenced by Braintree's sanitize-url

Installation

gem 'disinfect_url'

Usage

Requirements

This gem requires Ruby 2.4+

Basic Usage

Convert bad urls to "about:blank"

DisinfectUrl.sanitize("https://example.com")
# => https://example.com

DisinfectUrl.sanitize("http://example.com")
# => http://example.com

DisinfectUrl.sanitize("www.example.com")
# => www.example.com

DisinfectUrl.sanitize("mailto:hello@example.com")
# => mailto:hello@example.com

DisinfectUrl.sanitize("&#104;&#116;&#116;&#112;&#115;&#0000058//&#101;&#120;&#97;&#109;&#112;&#108;&#101;&#46;&#99;&#111;&#109;")
# => https://example.com

DisinfectUrl.sanitize("javascript:alert(document.domain)")
DisinfectUrl.sanitize("jAvasCrIPT:alert(document.domain)")
DisinfectUrl.sanitize("JaVaScRiP%0at:alert(document.domain)")
# => about:blank

#HTML encoded javascript:alert('XSS')
DisinfectUrl.sanitize("&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041")
# => about:blank

# Works the same way for href attribute within <a> tags
DisinfectUrl.sanitize(%q(<a href="javascript:alert('attack')">Example</a>))
# => <a href="about:blank">Example</a>

ActiveRecord Callbacks

before_validation :disinfect_website_url
before_validation :disinfect_biography

private

  def disinfect_website_url
    self.website_url = DisinfectUrl.sanitize(self.website_url)
  end

  def disinfect_biography
    self.biography = DisinfectUrl.sanitize(self.biography)
  end

Validation Note

This gem doesn't perform any validation for differentiating HTML vs URL. You may need to perform additional validation.

  def disinfect_website_url
    self.website_url = DisinfectUrl.sanitize(%q(<a href="https://example.com">Example</a>))
  end

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and the created tag, and push the .gem file to rubygems.org.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/stevenjcumming/disinfect_url. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.

License

The gem is available as open source under the terms of the MIT License.

Code of Conduct

Everyone interacting in the DisinfectUrl project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.