June 24th, 2008
It looks like I’ll be doing Flex RIA development, which I’m really looking forward to. Right now I need to tuck away a few links for further study…
Cairngen - for generating the basics for a Cairngorm Flex app:
http://code.google.com/p/cairngen/wiki/GettingStarted
Paul Williams - a series of blog posts on presentation tier design patterns with an eye to Flex:
http://weblogs.macromedia.com/paulw/
dpUint - Flex unit testing framework with async testing support baked-in:
http://code.google.com/p/dpuint/wiki/Introduction
Prana - an IoC for Flex… useful with Cairngorm:
http://www.herrodius.com/blog/64
Steven Weber very good introduction to Cairngorm:
http://www.adobe.com/devnet/flex/articles/cairngorm_pt1.html
Bruce Eckel articles on Artima:
http://www.artima.com/weblogs/viewpost.jsp?thread=212818
http://www.artima.com/weblogs/viewpost.jsp?thread=230610
And Getting Started with Flex at Adobe:
http://learn.adobe.com/wiki/display/Flex/Getting+Started
design design patterns flex Note to self ria Uncategorized
Posted in ria, Note to self, design | No Comments »
June 8th, 2007
I had all of our data being html-escaped as it was rendered to the page, but the problem is that other systems interact with ours — we send data to web analytics systems and to SalesForce.com. In that case you can’t count on escaping entities on display — you need to catch it on the way into your database.
I found a few sites with some fixes, though most were still focused on cleaning the data on display. I ended up taking Rick’s plugin and applying it at save time in the model object. I’m not sure it’s the cleanest — I’d almost certainly say there is a more elegant way to do this — but this was quick and works great.
It’s still basically designed to be used at output time:
<%= white_list @article.body %>
But instead I include the helper directly to a model and overwrite the attribute setters:
class Contact < ActiveRecord::Base
include WhiteListHelper
def name=(text) write_attribute(:name, white_list(text)) end
end
I tried setting up a before_filter and stepping through the param[] object, but my data was fairly simple and the above was dead easy.
rails rails xss security Uncategorized
Posted in rails | Comments Off