Fix XSS in Ruby on Rails

1. Find raw, html_safe, <%==, safe_join on untrusted parts, content_tag with escape: false, and helpers that build HTML strings by interpolation.
2. Print values with <%= %> and pass attributes through tag helpers (image_tag, tag.img, link_to); both escape for HTML text and quoted attributes.
3. For user-written rich text, use sanitize(html, tags: [...], attributes: [...]) with the smallest allowlist you need, not strip_tags plus raw.
4. Check URLs before link_to or href: parse them and allow only http and https; URI.parse refuses the tab and newline characters browsers would quietly delete.
5. Add a Content Security Policy (config/initializers/content_security_policy.rb) as a second layer, and regression tests that parse the page with an HTML5 parser.

The three implementations share one API and one test suite; only the code below changes. The tests load the one that IMPL names.

<img src="/avatar.svg" alt="<%== @name %>" width="64" height="64">
<h1><%= raw @name %></h1>
<p class="bio"><%= @bio.html_safe %></p>

<%= image_tag "/avatar.svg", alt: @name, width: 64, height: 64 %>
<h1><%= @name %></h1>
<p class="bio"><%= @bio %></p>

<% if web_url?(@website) %>
    <%= link_to "Website", @website %>
<% end %>

# Escaping keeps a URL inside its href attribute, but javascript:alert(1) is still a
# javascript: URL once escaped, so only http and https links are allowed. URI.parse refuses
# characters a browser would quietly delete, such as the tab in "java\tscript:".
def web_url?(url)
  %w[http https].include?(URI.parse(url).scheme&.downcase)
rescue URI::InvalidURIError
  false
end

<%# strip_tags removes every tag, so the text can go out raw and entities in old profiles (&eacute;) still render. %>
<img src="/avatar.svg" alt="<%= raw strip_tags(@name) %>" width="64" height="64">
<h1><%= raw strip_tags(@name) %></h1>
<p class="bio"><%= raw strip_tags(@bio) %></p>

The exploit tests send the attack and check that it fails; functional tests next to them keep ordinary requests working, so a fix that rejects everything fails too.

# Exploit: what a browser would run from the page must stay inert.

# No script elements, no event-handler attributes, and only http(s) links.
def assert_nothing_executable(page)
  assert_empty page.elements.select { |e| e.name == "script" }.map(&:text), "script element"
  handlers = page.elements.flat_map { |e| e.attribute_nodes.map(&:name).grep(/\Aon/).map { |n| "#{e.name} #{n}" } }
  assert_empty handlers, "event-handler attribute"
  page.links.each do |href|
    assert_includes ["", "http", "https"], Page.url_scheme(href), "link to a #{Page.url_scheme(href)}: URL: #{href.inspect}"
  end
end

test "exploit: script element in the bio does not run" do
  assert_nothing_executable(profile(name: "Mallory", bio: "<script>alert(document.domain)</script>"))
end

test "exploit: event-handler attribute in the bio does not run" do
  assert_nothing_executable(profile(name: "Mallory", bio: "<img src=x onerror=alert(document.domain)>"))
end

test "exploit: quote in the name cannot break out of the alt attribute" do
  name = '" onerror="alert(document.domain)'
  page = profile(name:)
  assert_nothing_executable(page)
  assert_equal name, avatar_alt(page)
end

test "exploit: javascript: website is not linked" do
  assert_nothing_executable(profile(name: "Mallory", website: "javascript:alert(document.domain)"))
end

test "exploit: tab inside the scheme does not smuggle a javascript: URL through" do
  # Browsers delete tabs and newlines from a URL before parsing it.
  assert_nothing_executable(profile(name: "Mallory", website: "java\tscript:alert(document.domain)"))
end

• html_safe does not make anything safe: it marks a string as already escaped, so Rails stops escaping it. raw(x) and <%== x %> do the same.
• strip_tags removes tags but not quotes, so raw(strip_tags(name)) in an attribute still breaks out of it: this card's wrong implementation shows a quote turning the alt text into an onerror attribute. It also mangles legitimate text that contains < and >.
• link_to escapes the URL for the attribute, but javascript:alert(1) is still a javascript: URL once escaped; blocking the scheme by name misses java\tscript: and upper-case variants.
• sanitize is for HTML you mean to keep: pass the smallest tags: and attributes: allowlist you need and test it with your own payloads; it is not a fix for text that should never contain markup.
• Rails 8.1.2.1, 8.0.4.1 and 7.2.3.1 fixed XSS in Action View tag helpers and in SafeBuffer#% (CVE-2026-33168 and CVE-2026-33170); stay on a patched release.

1. Run the tests in all three modes: IMPL=fixed must pass; IMPL=vulnerable and IMPL=wrong must fail (node ../../run-all.mjs xss/ruby-rails does this for you, in the pinned Ruby container).
2. Against your own pages, submit a script tag, an img with onerror, a quote followed by an event handler, and javascript: and java<TAB>script: links, then check the parsed page for scripts, on* attributes and non-http links.
3. Brakeman's CrossSiteScripting and LinkToHref warnings and Semgrep's template rules report raw, html_safe and link_to with a variable; neither sees a template chosen at run time, as here.

What each rule reported when it was run on this card's code, or what its source shows it covers where it was not run. A rule that exists for the weakness does not always catch it.

Download the project, install its dependencies once (this step needs the network), then run the tests against each implementation from the xss/ruby-railsfolder.

BUNDLE_PATH=vendor/bundle BUNDLE_FROZEN=true bundle install

# Expected: every test passes
IMPL=fixed BUNDLE_PATH=vendor/bundle bundle exec ruby -Itest test/profile_test.rb

# Expected: an exploit test fails
IMPL=vulnerable BUNDLE_PATH=vendor/bundle bundle exec ruby -Itest test/profile_test.rb

# Expected: a test fails
IMPL=wrong BUNDLE_PATH=vendor/bundle bundle exec ruby -Itest test/profile_test.rb

Without Ruby installed, run the same commands with Docker in the image the card was verified in, pinned by its digest. The named volumes keep the downloaded dependencies and the build cache between runs, so the test runs need no network.

docker run --rm --init \
  -v "$PWD":/card -w /card \
  -e BUNDLE_PATH=vendor/bundle \
  ruby:4.0.7-trixie@sha256:0192d5244fa068587325c3ef4f886fdb2d6775689757d598f9a5261d0f86d40e \
  sh -c 'BUNDLE_PATH=vendor/bundle BUNDLE_FROZEN=true bundle install'

# Expected: every test passes
docker run --rm --init --network=none \
  -v "$PWD":/card -w /card \
  -e IMPL=fixed -e BUNDLE_PATH=vendor/bundle \
  ruby:4.0.7-trixie@sha256:0192d5244fa068587325c3ef4f886fdb2d6775689757d598f9a5261d0f86d40e \
  sh -c 'bundle exec ruby -Itest test/profile_test.rb'

# Expected: an exploit test fails
docker run --rm --init --network=none \
  -v "$PWD":/card -w /card \
  -e IMPL=vulnerable -e BUNDLE_PATH=vendor/bundle \
  ruby:4.0.7-trixie@sha256:0192d5244fa068587325c3ef4f886fdb2d6775689757d598f9a5261d0f86d40e \
  sh -c 'bundle exec ruby -Itest test/profile_test.rb'

# Expected: a test fails
docker run --rm --init --network=none \
  -v "$PWD":/card -w /card \
  -e IMPL=wrong -e BUNDLE_PATH=vendor/bundle \
  ruby:4.0.7-trixie@sha256:0192d5244fa068587325c3ef4f886fdb2d6775689757d598f9a5261d0f86d40e \
  sh -c 'bundle exec ruby -Itest test/profile_test.rb'

Each run writes a JUnit report to reports/TEST-*.xml. From the top folder of the download, node run-all.mjs xss/ruby-rails runs all three modes and checks the expected results, in the container, so it needs Docker and Node.js but not the toolchain.

Download the project ZIP, 23 KB

Verified

Machine

Debian 13 (trixie) in Docker, on macOS 27.0 (Darwin 27.0.0, arm64)

Toolchain

• ruby 4.0.7 (ruby:4.0.7-trixie image, linux/arm64)
• bundler 4.0.20
• rails 8.1.4
• minitest 6.0.6
• minitest-reporters 1.8.0
• nokogiri 1.19.4
• semgrep 1.180.0
• brakeman 8.1.0

Matrix

fixed: 9 of 9 tests pass; vulnerable: 7 of 9 tests fail (5 exploit tests); wrong: 4 of 9 tests fail (2 exploit tests)

Test results

fixed 9/9 pass; vulnerable 7/9 fail (5 exploit tests, plus the two functional tests that show markup as typed); wrong 4/9 fail (2 exploit tests: the quote that breaks out of alt and java<TAB>script:, plus the same two functional tests), test runs offline (--network=none) after install; node examples/fixes/run-all.mjs ruby-rails --install, results/2026-10-11-fix-rails.json

Dependency freshness

Rails 8.1.4 was published on 2026-09-24 and Brakeman 8.1.0 on 2026-10-01. uri 1.1.2 and prettyprint 0.2.1 (both 2026-10-08) were three days old and are not security releases, so the Gemfile holds uri at 1.1.1 and prettyprint at 0.2.0; every other gem in Gemfile.lock is at least 13 days old. OSV reported no known vulnerabilities for any pin. Ruby 4.0.7 (2026-09-15) is the latest 4.0 release.

Versions and results hold for the toolchain above. The card's tests are the check: run them with your own versions before relying on the fix.

References

1. OWASP Cross Site Scripting Prevention Cheat Sheet
2. Rails Guides: Securing Rails Applications, cross-site scripting
3. Rails API: ActionView::Helpers::OutputSafetyHelper (raw, safe_join)
4. Rails API: ActionView::Helpers::SanitizeHelper (sanitize, strip_tags)
5. Rails API: ActionView::Helpers::UrlHelper (link_to)
6. Rails security releases 7.2.3.1, 8.0.4.1 and 8.1.2.1 (Action View and SafeBuffer XSS)
7. Brakeman: cross-site scripting
8. Brakeman: link_to href
9. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Attack patterns:

• CAPEC-63 at MITRE