class

Sanitize::Policy::HTMLSanitizer

Inherits Sanitize::Policy::Whitelist / Sanitize::Policy / Reference / Object

This policy serves as a good default configuration that should fit most typical use cases for HTML sanitization.

Configurations

It comes in three different configurations with different sets of supported HTML tags.

They only differ in the default configuration of allowed tags and attributes. The transformation behaviour is otherwise the same.

Common Configuration

.common: Accepts most standard tags and thus allows using a good amount of HTML features (see COMMON_SAFELIST).

This is the recommended default configuration and should work for typical use cases unless strong restrictions on allowed content is required.

sanitizer = Sanitize::Policy::HTMLSanitizer.common
sanitizer.process(%(&lt;a href=&quot;javascript:alert('foo')&quot;&gt;foo&lt;/a&gt;))        # =&gt; %(foo)
sanitizer.process(%(&lt;p&gt;&lt;a href=&quot;foo&quot;&gt;foo&lt;/a&gt;&lt;/p&gt;))                     # =&gt; %(&lt;p&gt;&lt;a href=&quot;foo&quot; rel=&quot;nofollow&quot;&gt;foo&lt;/a&gt;&lt;/p&gt;)
sanitizer.process(%(&lt;img src=&quot;foo.jpg&quot;&gt;))                              # =&gt; %(&lt;img src=&quot;foo.jpg&quot;&gt;)
sanitizer.process(%(&lt;table&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;td&gt;bar&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;)) # =&gt; %(&lt;table&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;td&gt;bar&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;)

NOTE: This configuration (nor any other) does not accept &lt;html&gt;, &lt;head&gt;, or # &lt;body&gt; tags by default. In order to use #sanitized_document they need to be added explicitly to accepted_arguments.

Basic Configuration

.basic: This set accepts some basic tags including paragraphs, headlines, lists, and images (see BASIC_SAFELIST).

sanitizer = Sanitize::Policy::HTMLSanitizer.basic
sanitizer.process(%(&lt;a href=&quot;javascript:alert('foo')&quot;&gt;foo&lt;/a&gt;))        # =&gt; %(foo)
sanitizer.process(%(&lt;p&gt;&lt;a href=&quot;foo&quot;&gt;foo&lt;/a&gt;&lt;/p&gt;))                     # =&gt; %(&lt;p&gt;&lt;a href=&quot;foo&quot; rel=&quot;nofollow&quot;&gt;foo&lt;/a&gt;&lt;/p&gt;)
sanitizer.process(%(&lt;img src=&quot;foo.jpg&quot;&gt;))                              # =&gt; %(&lt;img src=&quot;foo.jpg&quot;&gt;)
sanitizer.process(%(&lt;table&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;td&gt;bar&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;)) # =&gt; %(foo bar)

Inline Configuration

.inline: Accepts only a limited set of inline tags (see INLINE_SAFELIST).

sanitizer = Sanitize::Policy::HTMLSanitizer.inline
sanitizer.process(%(&lt;a href=&quot;javascript:alert('foo')&quot;&gt;foo&lt;/a&gt;))        # =&gt; %(foo)
sanitizer.process(%(&lt;p&gt;&lt;a href=&quot;foo&quot;&gt;foo&lt;/a&gt;&lt;/p&gt;))                     # =&gt; %(&lt;a href=&quot;foo&quot; rel=&quot;nofollow&quot;&gt;foo&lt;/a&gt;)
sanitizer.process(%(&lt;img src=&quot;foo.jpg&quot;&gt;))                              # =&gt; %()
sanitizer.process(%(&lt;table&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;td&gt;bar&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;)) # =&gt; %(foo bar)

Attribute Transformations

Attribute transformations are identical in all three configurations. But more advanced transforms won't apply if the respective attribute is not allowed in accepted_tags. So you can easily add additional elements and attributes to lower-tier sets and get the same attribute validation. For example: .inline doesn't include &lt;img&gt; tags, but when img is added to accepted_attributes, the policy validates img tags the same way as in .common.

URL Sanitization

This transformation applies to attributes that contain a URL (configurable through (url_attributes).

Makes sure the value is a valid URI (via URI.parse). If it does not parse, the attribute value is set to empty string.
Sanitizes the URI via URISanitizer (configurable trough uri_sanitizer). If the sanitizer returns nil`, the attribute value is set to empty string.

The same URISanitizer is used for any URL attributes.

Anchor Tags

For &lt;a&gt; tags with a href attribute, there are two transforms:

rel="nofollow" is added (can be disabled with add_rel_nofollow).
rel="noopener" is added to links with target attribute (can be disabled with add_rel_noopener).

Anchor tags the have neither a href, name or id attribute are stripped.

NOTE: name and id attributes are not in any of the default sets of accepted attributes, so they can only be used when explicitly enabled.

Image Tags

&lt;img&gt; tags are stripped if they don't have a src attribute.

Size Attributes

If a tag has width or height attributes, the values are validated to be numerical or percent values. By default, these attributes are only accepted for <img> tags.

Alignment Attribute

The align attribute is validated against allowed values for this attribute: center, left, right, justify, char. If the value is invalid, the attribute is stripped.

Classes

class attributes are filtered to accept only classes described by valid_classes. String values need to match the class name exactly, regex values need to match the entire class name.

class is accepted as a global attribute in the default configuration, but no values are allowed in valid_classes.

All classes can be accepted by adding the match-all regular expression /.*/ to valid_classes.

Constants

BASIC_SAFELIST = INLINE_SAFELIST.merge({"blockquote" => Set {"cite"}, "br" => Set(String).new, "h1" => Set(String).new, "h2" => Set(String).new, "h3" => Set(String).new, "h4" => Set(String).new, "h5" => Set(String).new, "h6" => Set(String).new, "hr" => Set(String).new, "img" => Set {"alt", "src", "longdesc", "width", "height", "align"}, "li" => Set(String).new, "ol" => Set {"start"}, "p" => Set {"align"}, "pre" => Set(String).new, "ul" => Set(String).new})

Compatible with basic Markdown features.

COMMON_SAFELIST = BASIC_SAFELIST.merge({"dd" => Set(String).new, "del" => Set {"cite"}, "details" => Set(String).new, "dl" => Set(String).new, "dt" => Set(String).new, "div" => Set(String).new, "ins" => Set {"cite"}, "kbd" => Set(String).new, "q" => Set {"cite"}, "ruby" => Set(String).new, "rp" => Set(String).new, "rt" => Set(String).new, "s" => Set(String).new, "samp" => Set(String).new, "strike" => Set(String).new, "sub" => Set(String).new, "summary" => Set(String).new, "sup" => Set(String).new, "table" => Set(String).new, "time" => Set {"datetime"}, "tbody" => Set(String).new, "td" => Set(String).new, "tfoot" => Set(String).new, "th" => Set(String).new, "thead" => Set(String).new, "tr" => Set(String).new, "tt" => Set(String).new, "var" => Set(String).new})

Accepts most standard tags and thus allows using a good amount of HTML features.

INLINE_SAFELIST = {"a" => Set {"href", "hreflang"}, "abbr" => Set(String).new, "acronym" => Set(String).new, "b" => Set(String).new, "code" => Set(String).new, "em" => Set(String).new, "i" => Set(String).new, "strong" => Set(String).new, "*" => Set {"dir", "lang", "title", "class"}}

Only limited elements for inline text markup.

Constructors

basic

Creates an instance which accepts more basic tags including paragraphs, headlines, lists, and images (see BASIC_SAFELIST).