@@ -15,11 +15,11 @@ module SanitizeHelper
15
15
16
16
# Sanitizes HTML input, stripping all but known-safe tags and attributes.
17
17
#
18
- # It also strips href/ src attributes with unsafe protocols like <tt> javascript:</tt> , while
18
+ # It also strips + href+ / + src+ attributes with unsafe protocols like + javascript:+ , while
19
19
# also protecting against attempts to use Unicode, ASCII, and hex character references to work
20
20
# around these protocol filters.
21
21
#
22
- # The default sanitizer is Rails::HTML5::SafeListSanitizer. See {Rails HTML
22
+ # The default sanitizer is + Rails::HTML5::SafeListSanitizer+ . See {Rails HTML
23
23
# Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
24
24
#
25
25
# Custom sanitization rules can also be provided.
@@ -29,24 +29,29 @@ module SanitizeHelper
29
29
#
30
30
# ==== Options
31
31
#
32
- # * <tt>:tags</tt> - An array of allowed tags.
33
- # * <tt>:attributes</tt> - An array of allowed attributes.
34
- # * <tt>:scrubber</tt> - A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
32
+ # [+:tags+]
33
+ # An array of allowed tags.
34
+ #
35
+ # [+:attributes+]
36
+ # An array of allowed attributes.
37
+ #
38
+ # [+:scrubber+]
39
+ # A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
35
40
# or {Loofah::Scrubber}[https://github.com/flavorjones/loofah] object that
36
41
# defines custom sanitization rules. A custom scrubber takes precedence over
37
42
# custom tags and attributes.
38
43
#
39
44
# ==== Examples
40
45
#
41
- # Normal use:
46
+ # ===== Normal use
42
47
#
43
48
# <%= sanitize @comment.body %>
44
49
#
45
- # Providing custom lists of permitted tags and attributes:
50
+ # ===== Providing custom lists of permitted tags and attributes
46
51
#
47
52
# <%= sanitize @comment.body, tags: %w(strong em a), attributes: %w(href) %>
48
53
#
49
- # Providing a custom Rails::HTML scrubber:
54
+ # ===== Providing a custom + Rails::HTML+ scrubber
50
55
#
51
56
# class CommentScrubber < Rails::HTML::PermitScrubber
52
57
# def initialize
@@ -65,9 +70,9 @@ module SanitizeHelper
65
70
# <%= sanitize @comment.body, scrubber: CommentScrubber.new %>
66
71
#
67
72
# See {Rails HTML Sanitizer}[https://github.com/rails/rails-html-sanitizer] for
68
- # documentation about Rails::HTML scrubbers.
73
+ # documentation about + Rails::HTML+ scrubbers.
69
74
#
70
- # Providing a custom Loofah::Scrubber:
75
+ # ===== Providing a custom + Loofah::Scrubber+
71
76
#
72
77
# scrubber = Loofah::Scrubber.new do |node|
73
78
# node.remove if node.name == 'script'
@@ -78,7 +83,9 @@ module SanitizeHelper
78
83
# <%= sanitize @comment.body, scrubber: scrubber %>
79
84
#
80
85
# See {Loofah's documentation}[https://github.com/flavorjones/loofah] for more
81
- # information about defining custom Loofah::Scrubber objects.
86
+ # information about defining custom +Loofah::Scrubber+ objects.
87
+ #
88
+ # ==== Global Configuration
82
89
#
83
90
# To set the default allowed tags or attributes across your application:
84
91
#
@@ -99,8 +106,8 @@ module SanitizeHelper
99
106
# # In config/application.rb
100
107
# config.action_view.sanitizer_vendor = Rails::HTML5::Sanitizer
101
108
#
102
- # NOTE: Rails::HTML5::Sanitizer is not supported on JRuby, so on JRuby platforms \Rails will
103
- # fall back to use Rails::HTML4::Sanitizer.
109
+ # NOTE: + Rails::HTML5::Sanitizer+ is not supported on JRuby, so on JRuby platforms \Rails will
110
+ # fall back to using + Rails::HTML4::Sanitizer+ .
104
111
def sanitize ( html , options = { } )
105
112
self . class . safe_list_sanitizer . sanitize ( html , options ) &.html_safe
106
113
end
0 commit comments