ri > Rails::Html::WhiteListSanitizer

man perldoc info pydoc3 ri search

📛 NAME

Rails::Html::WhiteListSanitizer < Rails::Html::Sanitizer

🚀 Quick Reference

Use Case	Command	Description
🛡️ Sanitize HTML input	sanitizer.sanitize(@article.body)	Strip unsafe tags/attributes from user content using the built‑in safe list
🎨 Sanitize CSS	sanitizer.sanitize_css('background-color: #000;')	Clean CSS property values (no options supported)
⚙️ Customize allowed tags & attributes	sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))	Override the default safe list for a single call
🔧 Set class‑level defaults	Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)	Change allowed tags globally for all instances
✂️ Use a custom scrubber	sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)	Apply a custom Loofah scrubber for fine‑grained control

📝 DESCRIPTION

Sanitizes HTML and CSS from an extensive safe list (see link further down).

⚠️ Whitespace

We can’t make any guarantees about whitespace being kept or stripped. Loofah uses Nokogiri, which wraps either a C or Java parser for the respective Ruby implementation. Those two parsers determine how whitespace is ultimately handled.

When the stripped markup will be rendered the user’s browser won’t take whitespace into account anyway. It might be better to suggest your users wrap their whitespace sensitive content in <pre> tags or that you do so automatically.

⚙️ Options

Sanitizes both HTML and CSS via the safe lists found here: https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safelist.rb

SafeListSanitizer also accepts options to configure the safe list used when sanitizing HTML. There’s a class level option:

Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)
Rails::Html::SafeListSanitizer.allowed_attributes = %w(id class style)

Tags and attributes can also be passed to sanitize. Passed options take precedence over the class level options.

📝 Examples

safe_list_sanitizer = Rails::Html::SafeListSanitizer.new

Sanitize CSS doesn’t take options:

safe_list_sanitizer.sanitize_css('background-color: #000;')

Default: sanitize via a extensive safe list of allowed elements:

safe_list_sanitizer.sanitize(@article.body)

Safe list via the supplied tags and attributes:

safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))

Safe list via a custom scrubber:

safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)

---

📚 Class Methods

• allowed_attributes
• allowed_tags
• new

🔧 Instance Methods

• sanitize
• sanitize_css

🏷️ Attributes

• attr_accessor :allowed_attributes
• attr_accessor :allowed_tags

📛 NAME 🚀 Quick Reference 📝 DESCRIPTION 📚 Class Methods 🔧 Instance Methods 🏷️ Attributes