RedCloth is a module for using Textile in Ruby. Textile is a simple text format that can be converted to HTML, eliminating the need to use HTML directly to create documents, blogs, or web pages.
The new version 4 promises to be faster and without the bugs from version 3. And indeed it feels more reliable and many of the earlier security concers have now been dealt with. For example:
RedCloth.new(“<script>alert(1)</script>”).to_html
now returns
<script>alert(1)</script>
instead of
<script>alert(1)</script>
in earlier versions. And it’s good that it escapes the input instead of deleting malicious parts. I tried many examples from the XSS cheatsheet and hand-crafted ones. The result is that nearly no malicious parts get through. Yes nearly.
The <code> tag gets through:
RedCloth.new(‘<code onmouseover=”bad_code_here”>asdf</code>’, [:filter_html]).to_html
<code onmouseover=”bad_code_here”>asdf</code>
I’ve created a ticket for that.
Also remember that CSS injection will work in textile, if you allow styles. See the earlier post for that.
Nevertheless the new version is far better. And in combination with a whitelist (namely Rails’ sanitize() method) it is even secure.
