Re: Questions about the Prohibition of String Subclasses in responses

[Eric Wong <normalperson@yhbt.net>]

Michael Koziarski <koziarski@gmail.com> wrote:
> 
> Hey Guys,
> 
> As I prepare to merge the new on-by-default XSS protection into rails
> I'm bumping up against a constraint in rack, and I'm having trouble
> figuring out why it's there.
> 
> http://github.com/chneukirchen/rack/blob/master/lib/rack/lint.rb#L465-475
> 
> Our XSS safe responses will fail this test because they return an
> instance of ActionView::SafeBuffer which is a subclass of String.  We
> use a subclass so that we can make all the concat and append
> operations escape their arguments.
> 
> What's the rationale for preventing me from sending a subclass of
> string?

Not speaking for anyone else here, but this may break C extensions at
this point.  It was probably done this way to make extensions easier to
implement.  The core Ruby IO functions all call rb_obj_as_string() to
convert their arguments to strings, but some extensions out there may
not[1].


[1] *my* C extensions are safe against this, of course :)

-- 
Eric Wong