王筝的博客
ruby学习

 

 

The SanitizeHelper module provides a set of methods for scrubbing text of undesired HTML elements. These helper methods extend Action View making them callable within your template files.

只允许 sanitize 方法中指定的标签和属性输出到页面,防止注入

 

sanitize(html, options = {})

 

Sanitizes HTML input, stripping all tags and attributes that aren’t whitelisted.

It also strips href/src attributes with unsafe protocols like javascript:, while also protecting against attempts to use Unicode, ASCII, and hex character references to work around these protocol filters.

The default sanitizer is Rails::Html::WhiteListSanitizer. See Rails HTML Sanitizers for more information.

Custom sanitization rules can also be provided.

Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid or even well-formed. For example, the output may still contain unescaped characters like <>, or &.

  • :tags – An array of allowed tags.
  • :attributes – An array of allowed attributes.
  • :scrubber – A Rails::Html scrubber or Loofah::Scrubber object that defines custom sanitization rules. A custom scrubber takes precedence over custom tags and attributes.

 

module AnnouncementsHelper
  def safe_content(content)
    sanitize(content, tags: %w(b br))
  end
end

 

 

<p>
  <strong><%= t 'content' %></strong>
  <%= safe_content @announcement.content %>
</p>

 

 

http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html

Leave a Reply