Cross-site scripting (ARCH6101)
Esta página aún no está disponible en tu idioma.
Key ruby.security.xss · Severity error · Category security · CWE CWE-79
Writing untrusted data into HTML without escaping (raw sinks, disabled auto-escaping) lets attackers run script in the victim’s browser.
Incorrect
Section titled “Incorrect”<div><%= raw params[:comment] %></div>Correct
Section titled “Correct”<div><%= params[:comment] %></div>Keep auto-escaping on; avoid raw/html_safe and sanitize content when markup is required.