Ruby on Rails: What are Erubis' disadvantages and why isn't it packaged with Rails by default? How t

Posted by williamjones on Stack Overflow See other posts from Stack Overflow or by williamjones
Published on 2010-05-23T04:12:54Z Indexed on 2010/05/23 4:20 UTC
Read the original article Hit count: 234

Filed under:

ruby-on-rails

|

cross-site-scripting

|

erubis

I just discovered Erubis, a replacement for the default view renderer for Ruby on Rails. However, from what I can tell from reading about it, it's superior across the board.

It is much faster.
It has many more options.
It can prevent cross site scripting without having to use h.

Does this have any disadvantages versus the standard erb renderer? Why isn't this the standard renderer packaged with Rails?

Also, the docs for Erubis say to install it just by installing the gem, and then add the following to environment.rb:

require 'erubis/helpers/rails_helper'
#Erubis::Helpers::RailsHelper.engine_class = Erubis::Eruby # or Erubis::FastEruby

Reading the docs, FastEruby seems to be just a faster renderer than Eruby. Why wouldn't it be default and used by everyone?

I'm highly interested in using the engine erubis::EscapedEruby which automatically calls h to escape html on fields from the database. Are there any gotchas I should be aware of or does this pretty much solve all cross site scripting?

© Stack Overflow or respective owner

Related posts about ruby-on-rails

Ruby on Rails - How can I start? [closed]

as seen on Programmers - Search for 'Programmers'
I have misconception in understanding the relationship between Ruby language and Ruby on Rails Framework. Because of 'I am an absolute beginner' in web development I have no idea if I have to grasp the fundamentals of Ruby before I go with Ruby on Rails! I also want to ask who is behind both Ruby… >>> More
DES3 decryption in Ruby on Rails

as seen on Stack Overflow - Search for 'Stack Overflow'
My RoR server receives a string, that was encrypted in C++ application using des3 with base64 encoding The cipher object is created so: cipher = OpenSSL::Cipher::Cipher::new("des3") cipher.key = key_str cipher.iv = iv_str key_str and iv_str: are string representations of key and initialization… >>> More
Ruby on rails: Image downloads with Authentication/Authorization/Time outs

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I'm having few doubts on implementing file downloads. I'm creating an app where I use attachment_fu with Amazon s3 to upload files. Things are working pretty well so far on uploading side. Now its the time to start the file downloads. Here is what I need, a logged in user search and browse… >>> More
Ruby on Rails deployment, on "thin" server with lot of attachments

as seen on Stack Overflow - Search for 'Stack Overflow'
A lot of PDFs are stored inside MySQL as a BLOB field for each PDF file. The average file size is 500K each. The Rails app will stream the :binary data as file downloads, where there is a user click on the download link. Assume there is a maximum of 5 users downloading 5 PDFs concurrently, what… >>> More
Apply Behavior Driven Development to Ruby on Rails with Rspec

as seen on Internet.com - Search for 'Internet.com'
Applying the Behavior Driven Development (BDD) methodology to your Rails development takes you beyond traditional Test Driven Development. Learn how to do it with the Ruby-based BDD framework RSpec. >>> More

Related posts about cross-site-scripting

Best Practice: Legitimate Cross-Site Scripting

as seen on Stack Overflow - Search for 'Stack Overflow'
While cross-site scripting is generally regarded as negative, I've run into several situations where it's necessary. I was recently working within the confines of a very limiting content management system. I needed to include database code within the page, but the hosting server didn't have anything… >>> More
How do I protect against cross-site scripting?

as seen on Stack Overflow - Search for 'Stack Overflow'
I am using php, mysql with smarty and I places where users can put comments and etc. I've already escaped characters before inserting into database for SQL Injection. What else do I need to do? >>> More
Cracking Websites with Cross Site Scripting

as seen on How to geek - Search for 'How to geek'
You may have heard the term ‘cross site scripting’ before, but what exactly is ‘it’ and why is it dangerous for a website? YouTube channel Computerphile presents a nice primer on the ‘how and why’ of cross site scripting and the dangers it presents in their latest… >>> More
ASP .NET Code analysis tool to check cross site scripting

as seen on Stack Overflow - Search for 'Stack Overflow'
I am aware of a tool which MS has provided which tells you about coss site scripting attack etc. The tool is http://www.microsoft.com/downloads/details.aspx?FamilyId=0178e2ef-9da8-445e-9348-c93f24cc9f9d&displaylang=en But are there tools which you have used for ASP .NET applications which do… >>> More
Whats up with cross site Scripting (getJSON) and flickr example

as seen on Stack Overflow - Search for 'Stack Overflow'
In past i had read the documentation about getJSON and there is an example with a flickr photo api. (the example with the [pussy]cats :-)). No I ask myself why is it possible, to access flickr directly with this example. Ive tried this by store this code on my local machine - it works but if I use… >>> More