class Sanitize

def self.clean(html, config = {})
  sanitize = Sanitize.new(config)
  sanitize.clean(html)
end

def self.clean!(html, config = {})
  sanitize = Sanitize.new(config)
  sanitize.clean!(html)
end

def clean(html)
  dupe = html.dup
  clean!(dupe) || dupe
end

def clean!(html)
  fragment = Hpricot(html)
  fragment.traverse_element do |node|
    if node.bogusetag? || node.doctype? || node.procins? || node.xmldecl?
      node.swap('')
      next
    end
    if node.comment?
      node.swap('') unless @config[:allow_comments]
    elsif node.elem?
      name = node.name.downcase
      # Delete any element that isn't in the whitelist.
      unless @config[:elements].include?(name)
        node.parent.replace_child(node, node.children)
        next
      end
      if @config[:attributes].has_key?(name)
        # Delete any attribute that isn't in the whitelist for this element.
        node.raw_attributes.delete_if do |key, value|
          !@config[:attributes][name].include?(key.downcase)
        end
        # Delete remaining attributes that use unacceptable protocols.
        if @config[:protocols].has_key?(name)
          protocol = @config[:protocols][name]
          node.raw_attributes.delete_if do |key, value|
            protocol.has_key?(key) && (!(value.downcase =~ /^([^:]+):/) ||
                !protocol[key].include?($1.downcase))
          end
        end
      else
        # Delete all attributes from elements with no whitelisted
        # attributes.
        node.raw_attributes = {}
      end
      # Add required attributes.
      if @config[:add_attributes].has_key?(name)
        node.raw_attributes.merge!(@config[:add_attributes][name])
      end
    end
  end
  # Make one last pass through the fragment and replace angle brackets with
  # entities in all text nodes. This helps eliminate certain types of
  # maliciously-malformed nested tags.
  fragment.traverse_element do |node|
    if node.text?
      node.swap(node.inner_text.gsub('<', '&lt;').gsub('>', '&gt;'))
    end
  end
  result = fragment.to_s
  return result == html ? nil : html[0, html.length] = result
end

def initialize(config = {})
  @config = Config::DEFAULT.merge(config)
end