Question

I’m trying to pass model attributes to javascript through html like this:

<script type="text/javascript">
  myModel = <%= MyModel.all.map{|m| m.attributes}.to_json.html_safe %>;
</script>

but, it’s not safe, because one of attribute values can be a malicious string:

"</script>Evil Code<script>"

How to make it safe again?

Answer 1

I’ve decided to make a helper function, which escapes each attribute with h method:

def safe_attributes_of model_class
  attributes = model_class.all.map do |model|
    model.attributes.each_with_object({}) do |(k,v), attrs| 
      attrs[k] = h(v)
    end
  end

  attributes.to_json.html_safe
end