I am able to inject javascript:alert `1`
or javascript:alert(1)
into the href
field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode brackets and back quotes.
How to solve this? What is the best method to prevent XSS in rails?