module ActionView::Helpers::SanitizeHelper
def sanitize(html, options = {})
config.action_view.sanitized_allowed_tags = ['strong', 'em', 'a']
# In config/application.rb
To set the default allowed tags or attributes across your application:
information about defining custom Loofah::Scrubber objects.
See {Loofah's documentation}[https://github.com/flavorjones/loofah] for more
<%= sanitize @comment.body, scrubber: scrubber %>
end
node.remove if node.name == 'script'
scrubber = Loofah::Scrubber.new do |node|
Providing a custom Loofah::Scrubber:
documentation about Rails::Html scrubbers.
See {Rails HTML Sanitizer}[https://github.com/rails/rails-html-sanitizer] for
<%= sanitize @comment.body, scrubber: CommentScrubber.new %>
end
end
name == 'style'
def scrub_attribute?(name)
end
node.text?
def skip_node?(node)
end
!%w(form script comment blockquote).include?(node.name)
def allowed_node?(node)
class CommentScrubber < Rails::Html::PermitScrubber
Providing a custom Rails::Html scrubber:
<%= sanitize @comment.body, tags: %w(strong em a), attributes: %w(href) %>
Providing custom whitelisted tags and attributes:
<%= sanitize @comment.body %>
Normal use:
==== Examples
custom tags and attributes.
defines custom sanitization rules. A custom scrubber takes precedence over
or {Loofah::Scrubber}[https://github.com/flavorjones/loofah] object that
* :scrubber - A {Rails::Html scrubber}[https://github.com/rails/rails-html-sanitizer]
* :attributes - An array of allowed attributes.
* :tags - An array of allowed tags.
==== Options
contain unescaped characters like <, >, or &.
resulting markup is valid or even well-formed. For example, the output may still
Please note that sanitizing user-provided text does not guarantee that the
Custom sanitization rules can also be provided.
Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
The default sanitizer is Rails::Html::WhiteListSanitizer. See {Rails HTML
ASCII, and hex character references to work around these protocol filters.
javascript:, while also protecting against attempts to use Unicode,
It also strips href/src attributes with unsafe protocols like
Sanitizes HTML input, stripping all tags and attributes that aren't whitelisted.
def sanitize(html, options = {}) self.class.white_list_sanitizer.sanitize(html, options).try(:html_safe) end