Ruby on Rails rails-html-sanitizer XSS 漏洞

XSS vulnerability in rails-html-sanitizer There is a XSS vulnerability in `Rails::Html::FullSanitizer` used by Action View's `strip_tags`. This vulnerability has been assigned the CVE identifier CVE-2015-7579. Versions Affected: 1.0.2 Not affected: 1.0.0, 1.0.1 Fixed Versions: 1.0.3 ### Impact Due to the way that `Rails::Html::FullSanitizer` is implemented, if an attacker passes an already escaped HTML entity to the input of Action View's `strip_tags` these entities will be unescaped what may cause a XSS attack if used in combination with `raw` or `html_safe`. For example: ``` strip_tags("&lt;script&gt;alert('XSS')&lt;/script&gt;") ``` Would generate: ``` <script>alert('XSS')</script> ``` After the fix it will generate: ``` &lt;script&gt;alert('XSS')&lt;/script&gt; ``` All users running an affected release should either upgrade or use one of the workarounds immediately. ### Releases The FIXED releases are available at the normal locations. ### Workarounds If you can't upgrade, please use the following monkey patch in an initializer that is loaded before your application: ``` $ cat config/initializers/strip_tags_fix.rb class ActionView::Base def strip_tags(html) self.class.full_sanitizer.sanitize(html) end end ``` ### 参考 * https://groups.google.com/forum/#!topic/rubyonrails-security/OU9ugTZcbjc