prevent HTML/JS injection attacks

Author: hone

middlewares/chat_backend.rb

@@ -1,6 +1,8 @@
 require 'faye/websocket'
 require 'thread'
 require 'redis'
+require 'json'
+require 'erb'
 
 module ChatDemo
   class ChatBackend
@@ -32,7 +34,7 @@ def call(env)
 
         ws.on :message do |event|
           p [:message, event.data]
-          @redis.publish(CHANNEL, event.data)
+          @redis.publish(CHANNEL, sanitize(event.data))
         end
 
         ws.on :close do |event|
@@ -48,5 +50,12 @@ def call(env)
         @app.call(env)
       end
     end
+
+    private
+    def sanitize(message)
+      json = JSON.parse(message)
+      json.each {|key, value| json[key] = ERB::Util.html_escape(value) }
+      JSON.generate(json)
+    end
   end
 end