Ruby Redcarpet without filter_html marked html_safe: XSS
Rule ID: vetkit.ruby.xss.markdown-unsanitized
Markdown rendered by Redcarpet without filter_html / escape_html is marked html_safe (XSS). Markdown passes raw HTML through, so <script> or <img onerror=...> in the text reaches the page.
Last updated:
Suite: Security
ruby
Markdown rendered by Redcarpet without filter_html / escape_html is marked html_safe (XSS). Markdown passes raw HTML through, so <script> or <img onerror=...> in the text reaches the page.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Create the renderer with Redcarpet::Render::HTML.new(filter_html: true) (or escape_html: true), or pass the rendered HTML through sanitize with an allow-list before marking it safe.
References
Source: packages/engine/rules/sast/ruby.yml.
Related checks
- Rails ERB raw and <%== print request data, causing XSS
- Rails html_safe and raw on dynamic strings cause XSS
- Rails link_to with request param allows javascript: XSS
- Rails http_basic_authenticate_with hardcoded password
- Rails constantize on request input enables code execution
- Ruby send and public_send with request-controlled method
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.