# ri > Rails::Html::WhiteListSanitizer

## [Rails::Html::WhiteListSanitizer](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3AWhiteListSanitizer/markdown) < [Rails::Html::Sanitizer](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3ASanitizer/markdown)

(from /home/chedong/.local/share/rdoc)
------------------------------------------------------------------------
=== [**Rails::Html::SafeListSanitizer**](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3ASafeListSanitizer/markdown)
Sanitizes html and css from an extensive safe list (see link further
down).

=== **Whitespace**
We can't make any guarantees about whitespace being kept or stripped.
Loofah uses Nokogiri, which wraps either a C or Java parser for the
respective Ruby implementation. Those two parsers determine how
whitespace is ultimately handled.

When the stripped markup will be rendered the users browser won't take
whitespace into account anyway. It might be better to suggest your users
wrap their whitespace sensitive content in pre tags or that you do so
automatically.

=== **Options**
Sanitizes both html and css via the safe lists found here:
<https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safel>
ist.rb

SafeListSanitizer also accepts options to configure the safe list used
when sanitizing html. There's a class level option:
[Rails::Html::SafeListSanitizer](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3ASafeListSanitizer/markdown).allowed_tags = %w(table tr td)
[Rails::Html::SafeListSanitizer](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3ASafeListSanitizer/markdown).allowed_attributes = %w(id class style)

Tags and attributes can also be passed to sanitize. Passed options take
precedence over the class level options.

=== **Examples**
safe_list_sanitizer = [Rails::Html::SafeListSanitizer](https://www.chedong.com/phpMan.php/perldoc/Rails%3A%3AHtml%3A%3ASafeListSanitizer/markdown).new

Sanitize css doesn't take options
safe_list_sanitizer.sanitize_css('background-color: #000;')

Default: sanitize via a extensive safe list of allowed elements
safe_list_sanitizer.sanitize(@article.body)

Safe list via the supplied tags and attributes
safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
attributes: %w(id class style))

Safe list via a custom scrubber
safe_list_sanitizer.sanitize(@article.body, scrubber:
ArticleScrubber.new)
------------------------------------------------------------------------
## Class methods:

  allowed_attributes
  allowed_tags
  new

## Instance methods:

  sanitize
  sanitize_css

## Attributes:

  attr_accessor allowed_attributes
  attr_accessor allowed_tags