Sanitizing CSS in Rails

Question

I want to allow the users of a web app that I\'m building to write their own CSS in order to customize their profile page.

However I am aware of this opening up for

Answer 1

There's also some code called css_file_sanitize: https://github.com/courtenay/css_file_sanitize

Comparing it to the Rails sanitize command I find that both use regular expressions to strip out undesirable portions of the CSS.

Here's the source for css_file_sanitize: https://github.com/courtenay/css_file_sanitize/blob/master/lib/css_sanitize.rb

Here's the source for Rails sanitize: https://github.com/rails/rails/blob/master/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb

Answer 2

Rails has a built-in css sanitizer

See http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize_css and its parent http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize

> ActionController::Base.helpers.sanitize_css('background:#fff')
=> "background: #fff;" 
> ActionController::Base.helpers.sanitize_css('javascript:alert("garr");')
=> ""