Module: ActionView::Helpers::SanitizeHelper

Extended by:
ActiveSupport::Concern
Included in:
ActionView::Helpers, TextHelper
Defined in:
lib/action_view/helpers/sanitize_helper.rb

Overview

Action View Sanitize Helpers

The SanitizeHelper module provides a set of methods for scrubbing text of undesired HTML elements. These helper methods extend Action View making them callable within your template files.

Defined Under Namespace

Modules: ClassMethods

Instance Method Summary collapse

Instance Method Details

#sanitize(html, options = {}) ⇒ Object

Sanitizes HTML input, stripping all but known-safe tags and attributes.

It also strips href/src attributes with unsafe protocols like javascript:, while also protecting against attempts to use Unicode, ASCII, and hex character references to work around these protocol filters.

The default sanitizer is Rails::HTML5::SafeListSanitizer. See Rails HTML Sanitizers for more information.

Custom sanitization rules can also be provided.

Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid or even well-formed.

Options

  • :tags - An array of allowed tags.

  • :attributes - An array of allowed attributes.

  • :scrubber - A Rails::HTML scrubber or Loofah::Scrubber object that defines custom sanitization rules. A custom scrubber takes precedence over custom tags and attributes.

Examples

Normal use:

<%= sanitize @comment.body %>

Providing custom lists of permitted tags and attributes:

<%= sanitize @comment.body, tags: %w(strong em a), attributes: %w(href) %>

Providing a custom Rails::HTML scrubber:

class CommentScrubber < Rails::HTML::PermitScrubber
  def initialize
    super
    self.tags = %w( form script comment blockquote )
    self.attributes = %w( style )
  end

  def skip_node?(node)
    node.text?
  end
end

<%= sanitize @comment.body, scrubber: CommentScrubber.new %>

See Rails HTML Sanitizer for documentation about Rails::HTML scrubbers.

Providing a custom Loofah::Scrubber:

scrubber = Loofah::Scrubber.new do |node|
  node.remove if node.name == 'script'
end

<%= sanitize @comment.body, scrubber: scrubber %>

See Loofah’s documentation for more information about defining custom Loofah::Scrubber objects.

To set the default allowed tags or attributes across your application:

# In config/application.rb
config.action_view.sanitized_allowed_tags = ['strong', 'em', 'a']
config.action_view.sanitized_allowed_attributes = ['href', 'title']

The default, starting in Rails 7.1, is to use an HTML5 parser for sanitization (if it is available, see NOTE below). If you wish to revert back to the previous HTML4 behavior, you can do so by setting the following in your application configuration:

# In config/application.rb
config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer

Or, if you’re upgrading from a previous version of Rails and wish to opt into the HTML5 behavior:

# In config/application.rb
config.action_view.sanitizer_vendor = Rails::HTML5::Sanitizer

NOTE: Rails::HTML5::Sanitizer is not supported on JRuby, so on JRuby platforms Rails will fall back to use Rails::HTML4::Sanitizer.



100
101
102
 
# File 'lib/action_view/helpers/sanitize_helper.rb', line 100

def sanitize(html, options = {})
  self.class.safe_list_sanitizer.sanitize(html, options)&.html_safe
end

#sanitize_css(style) ⇒ Object

Sanitizes a block of CSS code. Used by sanitize when it comes across a style attribute.



105
106
107
 
# File 'lib/action_view/helpers/sanitize_helper.rb', line 105

def sanitize_css(style)
  self.class.safe_list_sanitizer.sanitize_css(style)
end

#strip_links(html) ⇒ Object

Strips all link tags from html leaving just the link text.

strip_links('<a href="http://www.rubyonrails.org">Ruby on Rails</a>')
# => Ruby on Rails

strip_links('Please e-mail me at <a href="mailto:[email protected]">[email protected]</a>.')
# => Please e-mail me at [email protected].

strip_links('Blog: <a href="http://www.myblog.com/" class="nav" target=\"_blank\">Visit</a>.')
# => Blog: Visit.

strip_links('<<a href="https://example.org">malformed & link</a>')
# => &lt;malformed &amp; link



139
140
141
 
# File 'lib/action_view/helpers/sanitize_helper.rb', line 139

def strip_links(html)
  self.class.link_sanitizer.sanitize(html)
end

#strip_tags(html) ⇒ Object

Strips all HTML tags from html, including comments and special characters.

strip_tags("Strip <i>these</i> tags!")
# => Strip these tags!

strip_tags("<b>Bold</b> no more!  <a href='more.html'>See more here</a>...")
# => Bold no more!  See more here...

strip_tags("<div id='top-bar'>Welcome to my website!</div>")
# => Welcome to my website!

strip_tags("> A quote from Smith & Wesson")
# => &gt; A quote from Smith &amp; Wesson



122
123
124
 
# File 'lib/action_view/helpers/sanitize_helper.rb', line 122

def strip_tags(html)
  self.class.full_sanitizer.sanitize(html)&.html_safe
end