Rails - Sep 2006 - RedCloth !image! bug with filter_html

Hi all!

I am trying tu set up RedCloth for user-submitted comments. And here is 
my problem. The :filter_html option just breaks images :-(

For example, if I try in irb:

string= "Some textile !agif.gif! and textile again"
RedCloth.new(string, [:filter_html, :filter_styles]).to_html(:textile)

I get:

NoMethodError: You have a nil object when you didn''t expect it!
The error occured while evaluating nil.gsub
        from ./script/../config/../config/../lib/redcloth.rb:1118:in 
`clean_html''

Huh? Everything works fine if I remove :filter_html (but then, my HTML 
is potentially dangerous, and I prefer RedCloth''s html filter to
Rails''
sanitize method, which is only a blacklist, that is to say vulnerable).

Any hint?

Thank you!

Nauhaie

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

On 9/17/06, Nauhaie None
<rails-mailing-list-ARtvInVfO7ksV2N9l4h3zg@public.gmane.org>
wrote:
>
> Hi all!
>
> I am trying tu set up RedCloth for user-submitted comments. And here is
> my problem. The :filter_html option just breaks images :-(
>
> For example, if I try in irb:
>
> string= "Some textile !agif.gif! and textile again"
> RedCloth.new(string, [:filter_html, :filter_styles]).to_html(:textile)
>
> I get:
>
> NoMethodError: You have a nil object when you didn''t expect it!
> The error occured while evaluating nil.gsub
>         from ./script/../config/../config/../lib/redcloth.rb:1118:in
> `clean_html''
>
> Huh? Everything works fine if I remove :filter_html (but then, my HTML
> is potentially dangerous, and I prefer RedCloth''s html filter to
Rails''
> sanitize method, which is only a blacklist, that is to say vulnerable).
>
> Any hint?
>
> Thank you!
>
> Nauhaie
I have a white_list plugin:
http://svn.techno-weenie.net/projects/plugins/white_list/

Please use and abuse it, let me know if you find holes in it:
http://beast.caboo.se/forums/5/topics/319

-- 
Rick Olson
http://weblog.techno-weenie.net
http://mephistoblog.com

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Seems to work fine, thank you!

However, I think you should make it a module that can be accessed from a 
controller, too!

Nauhaie

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---