Plugins - Safe ERB - Agile Web Development

Overview Safe ERB lets you make sure that the string written by "<%= %>" in your rhtml template is escaped correctly. If you try to show the attributes in the ActiveRecord instance read from the database or the parameters received from the request without escaping them using "h" method, an exception will be raised. This will significantly reduce the possibility of putting cross-site scripting vuln

[kgbu]

Taintedなオブジェクトを処理するためのRails用プラグイン

[yzatkatamayu]

「If you try to show the attributes in the ActiveRecord instance read from the database or the parameters received from the request without escaping them using "h" method, an exception will be raised」