class Rails::Html::SafeListSanitizer

Rails::Html::SafeListSanitizer

Sanitizes html and css from an extensive safe list (see link further down).

Whitespace

We can't make any guarantees about whitespace being kept or stripped. Loofah uses Nokogiri, which wraps either a C or Java parser for the respective Ruby implementation. Those two parsers determine how whitespace is ultimately handled.

When the stripped markup will be rendered the users browser won't take whitespace into account anyway. It might be better to suggest your users wrap their whitespace sensitive content in pre tags or that you do so automatically.

Options

Sanitizes both html and css via the safe lists found here: github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safelist.rb

SafeListSanitizer also accepts options to configure the safe list used when sanitizing html. There's a class level option: #allowed_tags = %w(table tr td) #allowed_attributes = %w(id class style)

Tags and attributes can also be passed to sanitize. Passed options take precedence over the class level options.

Examples

safe_list_sanitizer = ::new

Sanitize css doesn't take options safe_list_sanitizer.sanitize_css('background-color: #000;')

Default: sanitize via a extensive safe list of allowed elements safe_list_sanitizer.sanitize(@article.body)

Safe list via the supplied tags and attributes safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))

Safe list via a custom scrubber safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)

Attributes

allowed_attributes[RW]
allowed_tags[RW]

Public Class Methods

new() click to toggle source
# File lib/rails/html/sanitizer.rb, line 113
def initialize
  @permit_scrubber = PermitScrubber.new
end

Public Instance Methods

sanitize(html, options = {}) click to toggle source
# File lib/rails/html/sanitizer.rb, line 117
def sanitize(html, options = {})
  return unless html
  return html if html.empty?

  loofah_fragment = Loofah.fragment(html)

  if scrubber = options[:scrubber]
    # No duck typing, Loofah ensures subclass of Loofah::Scrubber
    loofah_fragment.scrub!(scrubber)
  elsif allowed_tags(options) || allowed_attributes(options)
    @permit_scrubber.tags = allowed_tags(options)
    @permit_scrubber.attributes = allowed_attributes(options)
    loofah_fragment.scrub!(@permit_scrubber)
  else
    remove_xpaths(loofah_fragment, XPATHS_TO_REMOVE)
    loofah_fragment.scrub!(:strip)
  end

  properly_encode(loofah_fragment, encoding: 'UTF-8')
end
sanitize_css(style_string) click to toggle source
# File lib/rails/html/sanitizer.rb, line 138
def sanitize_css(style_string)
  Loofah::HTML5::Scrub.scrub_css(style_string)
end

Private Instance Methods

allowed_attributes(options) click to toggle source
# File lib/rails/html/sanitizer.rb, line 148
def allowed_attributes(options)
  options[:attributes] || self.class.allowed_attributes
end
allowed_tags(options) click to toggle source
# File lib/rails/html/sanitizer.rb, line 144
def allowed_tags(options)
  options[:tags] || self.class.allowed_tags
end