Question

Is it possible, in Rails 3.1, to escape HTML in markdown in HAML to avoid XSS? I mean when you do something like:

:markdown
  Hello #{@user.name}

Thanks.

Answer 1

For now I created this:

module Haml::Filters::SafeMarkdown
  include Haml::Filters::Base
  lazy_require "rdiscount", "peg_markdown", "maruku", "bluecloth"

  def render(text)
    engine = case @required
               when "rdiscount"
                 ::RDiscount
               when "peg_markdown"
                 ::PEGMarkdown
               when "maruku"
                 ::Maruku
               when "bluecloth"
                 ::BlueCloth
             end
    engine.new(Haml::Helpers.html_escape(text)).to_html
  end
end

and to make it easy to use it directly:

module SafeMarkdown
  def self.render(text)
    Haml::Filters.defined["safemarkdown"].render(text).html_safe
  end
end

It seems to work for now. Does anybody have a comment?