The :back option of the link_to method in Ruby on Rails is handy.
However, there is potential for Reflected XSS attacks through HTTP Referer pollution using dataURL.
I considered contributing to Rails itself, but due to backwards compatibility issues, I didn't think I could change that right away.
So I thought about adding a custom linter to this wonderful gem.
I figured other developers might have similar problems, so I have now issued a PR.
msasaki666
commented
2 months ago
The :back option of the link_to method in Ruby on Rails is handy. However, there is potential for Reflected XSS attacks through HTTP Referer pollution using dataURL.
↓ Rails doesn't validate dataURL. https://github.com/rails/rails/blob/main/actionview/lib/action_view/helpers/url_helper.rb#L58
I considered contributing to Rails itself, but due to backwards compatibility issues, I didn't think I could change that right away. So I thought about adding a custom linter to this wonderful gem. I figured other developers might have similar problems, so I have now issued a PR.
If you don't need it, feel free to close it.