Skip to content

Commit 3348467

Browse files
committed
doc: small improvements to README
1 parent b14f89d commit 3348467

File tree

1 file changed

+8
-9
lines changed

1 file changed

+8
-9
lines changed

README.md

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
# Rails HTML Sanitizers
22

3-
In Rails 4.2 and above this gem will be responsible for sanitizing HTML fragments in Rails
4-
applications, i.e. in the `sanitize`, `sanitize_css`, `strip_tags` and `strip_links` methods.
3+
This gem is responsible for sanitizing HTML fragments in Rails applications. Specifically, this is the set of sanitizers used to implement the Action View `SanitizerHelper` methods `sanitize`, `sanitize_css`, `strip_tags` and `strip_links`.
4+
5+
Rails HTML Sanitizer is only intended to be used with Rails applications. If you need similar functionality but aren't using Rails, consider using the underlying sanitization library [Loofah](https://github.com/flavorjones/loofah) directly.
56

6-
Rails HTML Sanitizer is only intended to be used with Rails applications. If you need similar functionality in non Rails apps consider using [Loofah](https://github.com/flavorjones/loofah) directly (that's what handles sanitization under the hood).
77

88
## Usage
99

1010
### A note on HTML entities
1111

12-
__Rails HTML sanitizers are intended to be used by the view layer, at page-render time. They are *not* intended to sanitize persisted strings that will sanitized *again* at page-render time.__
12+
__Rails HTML sanitizers are intended to be used by the view layer, at page-render time. They are *not* intended to sanitize persisted strings that will be sanitized *again* at page-render time.__
1313

14-
Proper HTML sanitization will replace some characters with HTML entities. For example, `<` will be replaced with `&lt;` to ensure that the markup is well-formed.
14+
Proper HTML sanitization will replace some characters with HTML entities. For example, text containing a `<` character will be updated to contain `&lt;` to ensure that the markup is well-formed.
1515

1616
This is important to keep in mind because __HTML entities will render improperly if they are sanitized twice.__
1717

@@ -42,7 +42,7 @@ In versions < 1.6, the only module defined by this library was `Rails::Html`. St
4242

4343
- `Rails::HTML` for general functionality (replacing `Rails::Html`)
4444
- `Rails::HTML4` containing sanitizers that parse content as HTML4
45-
- `Rails::HTML5` containing sanitizers that parse content as HTML5
45+
- `Rails::HTML5` containing sanitizers that parse content as HTML5 (if supported)
4646

4747
The following aliases are maintained for backwards compatibility:
4848

@@ -187,6 +187,7 @@ html_fragment = Loofah.fragment('<a><span>text</span></a>')
187187
html_fragment.scrub!(scrubber)
188188
html_fragment.to_s # => "<a></a>"
189189
```
190+
190191
#### Custom Scrubbers
191192

192193
You can also create custom scrubbers in your application if you want to.
@@ -250,9 +251,7 @@ See [CONTRIBUTING](CONTRIBUTING.md).
250251
251252
### Security reports
252253
253-
Trying to report a possible security vulnerability in this project? Please
254-
check out our [security policy](https://rubyonrails.org/security) for
255-
guidelines about how to proceed.
254+
Trying to report a possible security vulnerability in this project? Please check out the [Rails project's security policy](https://rubyonrails.org/security) for instructions.
256255
257256
258257
## License

0 commit comments

Comments
 (0)