Avoiding script injection when rendering ERB
Bad (but not obviously so): data = { greeting: "Hello, world!" } ERB.new(" <h1>Show greeting:</h1> <p><%= greeting %></p> ").result_with_hash(data) # => <h1>Show greeting:</h1> <p>Hello, world!</p> The question is - what happens if greeting is something different…like <script>alert('greeting!')</script>? Perhaps, if you’re used to Rails, not what you might expect: data = { greeting: "<script>alert('greeting!')</script>" } ERB.new(" <h1>Show greeting:</h1> <p><%= greeting %></p>...
