render_template_fix.rb
render_template_fix.rb
| 1 | # Fix: escape user-supplied template variables before render |
| 2 | module TemplateRenderer |
| 3 | def safe_render(template, vars) |
| 4 | sanitized = vars.transform_values { |v| CGI.escapeHTML(v.to_s) } |
| 5 | template.gsub(/\{\{(\w+)\}\}/) { sanitized[$1] || '' } |
| 6 | end |
| 7 | end |
| 8 | |
| 9 | # Usage |
| 10 | renderer = TemplateRenderer.new |
| 11 | output = renderer.safe_render("Hello {{name}}", { "name" => user_input }) |
Comments (1)
A
asaba · May 30, 2018
The
<a> being passed through is an inconsistency that could lead to a user clicking on a bad link.