Databases
StackOverflow2013
Postsdbo
POSafe Erb plugin Implementation Issue
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSafe Erb plugin Implementation Issue
    text
    copied!<p>I am trying to implement the Safe Erb Plugin in my rails 2.0.2 app. I am using this version for project specific purposes along with Ruby 1.8.7.</p> <p>I have referred to the following tutorials:</p> <p><a href="http://www.railslodge.com/plugins/430-safe-erb" rel="nofollow">http://www.railslodge.com/plugins/430-safe-erb</a> http://agilewebdevelopment.com/plugins/safe_erb</p> <p>I could make only some sense of the above Url's as I am a newbie to Rails and Rails related plugins. I honestly also found the above tutorials to be very generic. </p> <p>I really also couldn't relate this plugin's use to a great extent in terms of real world sense from the above tutorials. Could you please enlighten me on its usage on a day to day real world....?</p> <p>I have implemented a books appl which has an author, title and publishing date. I am currently facing issues implementing the taint feature of this plugin</p> <p>In the second tutorial, they say we need to call the tainted? method from the Objects class. I have done this in my create method of my books_controller.rb. The code for the create method looks like this:</p> <pre><code> def create @book = Book.new(params[:book]) @book.publishing_date = params[:publishing_date] respond_to do |format| if @book.save flash[:notice] = 'Book was successfully created.' format.html { redirect_to(@book) } format.xml { render :xml =&gt; @book, :status =&gt; :created, :location =&gt; @book } else format.html { render :action =&gt; "new" } format.xml { render :xml =&gt; @book.errors, :status =&gt; :unprocessable_entity } end if @book.tainted? flash[:notice] = 'Books are tainted' format.html { redirect_to(@book) } format.xml { render :xml =&gt; @book, :status =&gt; :created, :location =&gt; @book } else flash[:notice] = 'Books aren\'t tainted' format.html { render :action =&gt; "new" } format.xml { render :xml =&gt; @book.errors, :status =&gt; :unprocessable_entity } end end </code></pre> <p>Upon creating a new book record I get a notice saying that "Books aren't tainted". I have copied this plugin into my vendor/plugins directory.</p> <p>As per the second tutorial url they say "The string becomes tainted when it is read from IO, such as the data read from the DB or HTTP request."</p> <p>But its not happening in my case when I try to create a new book record. Do I need to explicitly taint the string input I am taking(its currently in varchar as per DB types - I guess that shouldn't be an issue). If yes could you please tell me how to do it.</p> <p>OR</p> <p>if its not the above case.. Am I missing something?</p> <p>Any insights on this would be really appreciated.</p> <p>Thank you..</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload