Listing 1

/12/rack-notags.rb

# # # #
# Rack::NoTags removes < and > from all incoming requests
# This software is licensed under the CC-GNU GPL version 2.0 or later.
# # # #

module Rack
  class NoTags
    Patterns = { # replacement => [ array, of, patterns ]

:brackets_only => {
  '&lt;' => ['<'],
  '&gt;' => ['>'] },

:valid_xml => { # similar to Rack::Utils#escape_html
  '&lt;'  => ['<'],
  '&gt;'  => ['>'],
  '&amp;' => ['&'],
  '&#39'  => ["'"],
  '&quot' => ['"'] },

:paranoid => { # encodings which might be interpreted as < or > in some situations
  '' => %w[ < > %3C %3E ] + [
        /&[lg]t;?/i,
        /&#0{0,5}6[02];?/,
        /&#x0{0,5}3[ce];?/i ]}
    }

    def initialize(app, mode = :brackets_only)
      @app = app
      @patterns = Patterns[mode.to_sym]
    end
    
    def call(env)
      # get form params in a nice format
      params = Rack::Utils.parse_query(env['rack.input'].read, "&")
      
      # remove @patterns
      params = strip_all(params)
      
      # update envirionment
      env["rack.input"] = StringIO.new(Rack::Utils.build_query(params))
      
      @app.call(env)
    end 
   
  private
    
    # applies each 'to-substitute'-pattern to the string
    def strip(string)
      @patterns.each{|replacement,patterns|
        patterns.each{|pattern|
          string = string.gsub(pattern, replacement)
        }
      }
    
      string
    end
    
    # looks at every param-element an sends it to the strip method
    def strip_all(params)
      ret = {}
      params.each{ |param,value|
        ret[strip(param)] = value.is_a?(Array) ? value.map{|v|strip(v)} : strip(value)
      }
      
      ret
    end
    
  end
end