Home/ Questions/Q 5968033
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T20:01:53+00:00

I have a model which has a template field. This template is HTML and

  • 0

I have a model which has a template field. This template is HTML and has variables which get substituted. This template is then converted into a PDF using wicked_pdf.

How should I take the template which the user enters and safely do variable substitution? Allowing it to be an ERB template seems to be setting myself up for some huge security holes. What safe solutions are there?

Edit:

So, for example, I have my template class/model which has two fields, a name and an HTML field. This is a user editable class. There will be specific variables available to the HTML in the template class (Company Name, price, etc.). I am hoping to use a HTML templating system, but since this is user created content, it isn’t trusted. Only variable substitution will be done, nothing more.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Rails provides a couple of helper functions, namely hto escape values on display for preventing such behavior.
    <%= h @user.name %>

    h is an alias of html_escape

    • 0