安全 Rails 5.0 API 模式中，如何在收到参数之前，就统一进行 xss 过滤？

breeze · July 25, 2016 · Last by novtopro replied at July 27, 2016 · 7026 hits

如题。希望像 permit(健壮参数) 一样，不需要在后续的实际业务中关心参数过滤的问题

novtopro #1 July 25, 2016

Though it's still buggy sometimes, I'd like to recommend you to check dry-validation out. I think you will like it. The hanami-validation project takes a lot from it.

1 likes

breeze #2 July 25, 2016

#1 楼 @novtopro Thank,I will seriously to check it

breeze #3 July 26, 2016

#1 楼 @novtopro 并不能像题目那样解决问题～希望有更好的方法

yingce #4 July 27, 2016

@breeze 我用的是 rails_param 包我自己 fork 了一个分支然后使用 optional 或者 requires 时候会自动把参数名加到一个数组里面，然后写了一个 strong_params 方法可以调用

5 Floor has deleted

novtopro #6 July 27, 2016

You have to figure out how to integrate the gem with you application by yourself. By the way, rails_param just sucks! It's ugly as far as I see.

7 Floor has deleted

You need to Sign in before reply, if you don't have an account, please Sign up first.