Skip to content

Commit e8656f8

Browse files
Clean up AV::Helpers::SanitizeHelper#sanitize doc [ci-skip]
1 parent d1411b2 commit e8656f8

File tree

1 file changed

+20
-13
lines changed

1 file changed

+20
-13
lines changed

actionview/lib/action_view/helpers/sanitize_helper.rb

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ module SanitizeHelper
1515

1616
# Sanitizes HTML input, stripping all but known-safe tags and attributes.
1717
#
18-
# It also strips href/src attributes with unsafe protocols like <tt>javascript:</tt>, while
18+
# It also strips +href+ / +src+ attributes with unsafe protocols like +javascript:+, while
1919
# also protecting against attempts to use Unicode, ASCII, and hex character references to work
2020
# around these protocol filters.
2121
#
22-
# The default sanitizer is Rails::HTML5::SafeListSanitizer. See {Rails HTML
22+
# The default sanitizer is +Rails::HTML5::SafeListSanitizer+. See {Rails HTML
2323
# Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
2424
#
2525
# Custom sanitization rules can also be provided.
@@ -29,24 +29,29 @@ module SanitizeHelper
2929
#
3030
# ==== Options
3131
#
32-
# * <tt>:tags</tt> - An array of allowed tags.
33-
# * <tt>:attributes</tt> - An array of allowed attributes.
34-
# * <tt>:scrubber</tt> - A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
32+
# [+:tags+]
33+
# An array of allowed tags.
34+
#
35+
# [+:attributes+]
36+
# An array of allowed attributes.
37+
#
38+
# [+:scrubber+]
39+
# A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
3540
# or {Loofah::Scrubber}[https://github.com/flavorjones/loofah] object that
3641
# defines custom sanitization rules. A custom scrubber takes precedence over
3742
# custom tags and attributes.
3843
#
3944
# ==== Examples
4045
#
41-
# Normal use:
46+
# ===== Normal use
4247
#
4348
# <%= sanitize @comment.body %>
4449
#
45-
# Providing custom lists of permitted tags and attributes:
50+
# ===== Providing custom lists of permitted tags and attributes
4651
#
4752
# <%= sanitize @comment.body, tags: %w(strong em a), attributes: %w(href) %>
4853
#
49-
# Providing a custom Rails::HTML scrubber:
54+
# ===== Providing a custom +Rails::HTML+ scrubber
5055
#
5156
# class CommentScrubber < Rails::HTML::PermitScrubber
5257
# def initialize
@@ -65,9 +70,9 @@ module SanitizeHelper
6570
# <%= sanitize @comment.body, scrubber: CommentScrubber.new %>
6671
#
6772
# See {Rails HTML Sanitizer}[https://github.com/rails/rails-html-sanitizer] for
68-
# documentation about Rails::HTML scrubbers.
73+
# documentation about +Rails::HTML+ scrubbers.
6974
#
70-
# Providing a custom Loofah::Scrubber:
75+
# ===== Providing a custom +Loofah::Scrubber+
7176
#
7277
# scrubber = Loofah::Scrubber.new do |node|
7378
# node.remove if node.name == 'script'
@@ -78,7 +83,9 @@ module SanitizeHelper
7883
# <%= sanitize @comment.body, scrubber: scrubber %>
7984
#
8085
# See {Loofah's documentation}[https://github.com/flavorjones/loofah] for more
81-
# information about defining custom Loofah::Scrubber objects.
86+
# information about defining custom +Loofah::Scrubber+ objects.
87+
#
88+
# ==== Global Configuration
8289
#
8390
# To set the default allowed tags or attributes across your application:
8491
#
@@ -99,8 +106,8 @@ module SanitizeHelper
99106
# # In config/application.rb
100107
# config.action_view.sanitizer_vendor = Rails::HTML5::Sanitizer
101108
#
102-
# NOTE: Rails::HTML5::Sanitizer is not supported on JRuby, so on JRuby platforms \Rails will
103-
# fall back to use Rails::HTML4::Sanitizer.
109+
# NOTE: +Rails::HTML5::Sanitizer+ is not supported on JRuby, so on JRuby platforms \Rails will
110+
# fall back to using +Rails::HTML4::Sanitizer+.
104111
def sanitize(html, options = {})
105112
self.class.safe_list_sanitizer.sanitize(html, options)&.html_safe
106113
end

0 commit comments

Comments
 (0)