1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
module Loofah
module Helpers
class << self
#
# A replacement for Rails's built-in +strip_tags+ helper.
#
# Loofah::Helpers.strip_tags("<div>Hello <b>there</b></div>") # => "Hello there"
#
def strip_tags(string_or_io)
Loofah.fragment(string_or_io).text
end
#
# A replacement for Rails's built-in +sanitize+ helper.
#
# Loofah::Helpers.sanitize("<script src=http://ha.ckers.org/xss.js></script>") # => "<script src=\"http://ha.ckers.org/xss.js\"></script>"
#
def sanitize(string_or_io)
loofah_fragment = Loofah.fragment(string_or_io)
loofah_fragment.scrub!(:strip)
loofah_fragment.xpath("./form").each { |form| form.remove }
loofah_fragment.to_s
end
#
# A replacement for Rails's built-in +sanitize_css+ helper.
#
# Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
#
def sanitize_css style_string
::Loofah::HTML5::Scrub.scrub_css style_string
end
#
# A helper to remove extraneous whitespace from text-ified HTML
# TODO: remove this in a future major-point-release.
#
def remove_extraneous_whitespace(string)
Loofah.remove_extraneous_whitespace string
end
end
module ActionView
module ClassMethods # :nodoc:
def full_sanitizer
@full_sanitizer ||= ::Loofah::Helpers::ActionView::FullSanitizer.new
end
def white_list_sanitizer
@white_list_sanitizer ||= ::Loofah::Helpers::ActionView::WhiteListSanitizer.new
end
end
#
# Replacement class for Rails's HTML::FullSanitizer.
#
# To use by default, call this in an application initializer:
#
# ActionView::Helpers::SanitizeHelper.full_sanitizer = ::Loofah::Helpers::ActionView::FullSanitizer.new
#
# Or, to generally opt-in to Loofah's view sanitizers:
#
# Loofah::Helpers::ActionView.set_as_default_sanitizer
#
class FullSanitizer
def sanitize html, *args
Loofah::Helpers.strip_tags html
end
end
#
# Replacement class for Rails's HTML::WhiteListSanitizer.
#
# To use by default, call this in an application initializer:
#
# ActionView::Helpers::SanitizeHelper.white_list_sanitizer = ::Loofah::Helpers::ActionView::WhiteListSanitizer.new
#
# Or, to generally opt-in to Loofah's view sanitizers:
#
# Loofah::Helpers::ActionView.set_as_default_sanitizer
#
class WhiteListSanitizer
def sanitize html, *args
Loofah::Helpers.sanitize html
end
def sanitize_css style_string, *args
Loofah::Helpers.sanitize_css style_string
end
end
end
end
end
|
