csisnett
How to render user inputted html safely with phoenix
Hi everybody!
I have a description field of a Project schema which I plan to edit with
a wysiwyg editor, so I wanted to save the string as html. I want to show the description html in the Project page by using the Phoenix raw function but I’m not sure if this is safe, especially as users would be able to edit their projects.
How can I make sure the html I render is safe?
If you know where I can learn more on sanitizing with phoenix it’d be of great help
Most Liked
seanmor5
Does the string have to be HTML? Can your WYSIWYG be a Markdown editor? If so, you can store the description as Markdown and parse it using something like Earmark.
If not, this might be helpful: GitHub - rrrene/html_sanitize_ex: HTML sanitizer for Elixir · GitHub
NobbZ
Well, some editors spit out markdown, others restructured text, some plain HTML. For those that don’t give you the HTML, you need to render the source into HTML.
Rendering it each time the contents is requested might hurt server performance, therefore prerendered version is often cached in the database.
seanmor5
You could use both (kind of like how this editor works) and use the markdown_html/1 function in the HTML Sanitizer package.
Last Post!
csisnett
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Build Elixir applications with speed and confidence.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"