ri > Rails::Html

man perldoc info pydoc3 ri search

<h2>📘 NAME</h2>
<p><a href="/phpMan.php/ri/Rails::Html">Rails::Html</a></p>

<h2>🚀 Quick Reference</h2>
<table>
<tr><th>Use Case</th><th>Command</th><th>Description</th></tr>
<tr><td>Sanitize HTML with default safe list</td><td><code>sanitizer.sanitize(@article.body)</code></td><td>Removes all tags and attributes not in the extensive safe list.</td></tr>
<tr><td>Sanitize HTML with custom allowed tags/attributes</td><td><code>sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))</code></td><td>Allows only specified tags and attributes.</td></tr>
<tr><td>Sanitize CSS</td><td><code>sanitizer.sanitize_css('background-color: #000;')</code></td><td>Strips dangerous CSS properties, keeping safe ones.</td></tr>
<tr><td>Use custom scrubber</td><td><code>sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)</code></td><td>Applies a custom scrubber for fine-grained control.</td></tr>
<tr><td>Set class-level safe list</td><td><code>Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)</code></td><td>Configure default allowed tags across all sanitizer instances.</td></tr>
</table>

<h2>📦 Constants</h2>
<ul>
<li><code>WhiteListSanitizer</code> — An alias for <code>Rails::Html::SafeListSanitizer</code>. Sanitizes HTML and CSS from an extensive safe list (see link further down).</li>
<li><code>XPATHS_TO_REMOVE</code> — [not documented]</li>
</ul>

<h3>🧹 Whitespace</h3>
<p>We can't make any guarantees about whitespace being kept or stripped. <u>Loofah uses Nokogiri, which wraps either a C or Java parser for the respective Ruby implementation.</u> Those two parsers determine how whitespace is ultimately handled.</p>
<p><u>When the stripped markup will be rendered the users browser won't take whitespace into account anyway.</u> It might be better to suggest your users wrap their whitespace sensitive content in <code>&lt;pre&gt;</code> tags or that you do so automatically.</p>

<h3>⚙️ Options</h3>
<p><u>Sanitizes both HTML and CSS via the safe lists found here:</u> <a href="https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safelist.rb" rel="noopener noreferrer">https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safelist.rb</a></p>
<p><u>SafeListSanitizer also accepts options to configure the safe list used when sanitizing HTML.</u> There's a class level option:</p>
<pre><code>Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)
Rails::Html::SafeListSanitizer.allowed_attributes = %w(id class style)</code></pre>
<p>Tags and attributes can also be passed to <code>sanitize</code>. Passed options take precedence over the class level options.</p>

<h3>💡 Examples</h3>
<pre><code>safe_list_sanitizer = Rails::Html::SafeListSanitizer.new</code></pre>
<p><u>Sanitize CSS doesn't take options</u></p>
<pre><code>safe_list_sanitizer.sanitize_css('background-color: #000;')</code></pre>
<p><u>Default: sanitize via an extensive safe list of allowed elements</u></p>
<pre><code>safe_list_sanitizer.sanitize(@article.body)</code></pre>
<p><u>Safe list via the supplied tags and attributes</u></p>
<pre><code>safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
attributes: %w(id class style))</code></pre>
<p><u>Safe list via a custom scrubber</u></p>
<pre><code>safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)</code></pre>