|
1 | 1 | # Rails HTML Sanitizers
|
2 | 2 |
|
3 |
| -In Rails 4.2 and above this gem will be responsible for sanitizing HTML fragments in Rails |
4 |
| -applications, i.e. in the `sanitize`, `sanitize_css`, `strip_tags` and `strip_links` methods. |
| 3 | +This gem is responsible for sanitizing HTML fragments in Rails applications. Specifically, this is the set of sanitizers used to implement the Action View `SanitizerHelper` methods `sanitize`, `sanitize_css`, `strip_tags` and `strip_links`. |
| 4 | + |
| 5 | +Rails HTML Sanitizer is only intended to be used with Rails applications. If you need similar functionality but aren't using Rails, consider using the underlying sanitization library [Loofah](https://github.com/flavorjones/loofah) directly. |
5 | 6 |
|
6 |
| -Rails HTML Sanitizer is only intended to be used with Rails applications. If you need similar functionality in non Rails apps consider using [Loofah](https://github.com/flavorjones/loofah) directly (that's what handles sanitization under the hood). |
7 | 7 |
|
8 | 8 | ## Usage
|
9 | 9 |
|
10 | 10 | ### A note on HTML entities
|
11 | 11 |
|
12 |
| -__Rails HTML sanitizers are intended to be used by the view layer, at page-render time. They are *not* intended to sanitize persisted strings that will sanitized *again* at page-render time.__ |
| 12 | +__Rails HTML sanitizers are intended to be used by the view layer, at page-render time. They are *not* intended to sanitize persisted strings that will be sanitized *again* at page-render time.__ |
13 | 13 |
|
14 |
| -Proper HTML sanitization will replace some characters with HTML entities. For example, `<` will be replaced with `<` to ensure that the markup is well-formed. |
| 14 | +Proper HTML sanitization will replace some characters with HTML entities. For example, text containing a `<` character will be updated to contain `<` to ensure that the markup is well-formed. |
15 | 15 |
|
16 | 16 | This is important to keep in mind because __HTML entities will render improperly if they are sanitized twice.__
|
17 | 17 |
|
@@ -42,7 +42,7 @@ In versions < 1.6, the only module defined by this library was `Rails::Html`. St
|
42 | 42 |
|
43 | 43 | - `Rails::HTML` for general functionality (replacing `Rails::Html`)
|
44 | 44 | - `Rails::HTML4` containing sanitizers that parse content as HTML4
|
45 |
| -- `Rails::HTML5` containing sanitizers that parse content as HTML5 |
| 45 | +- `Rails::HTML5` containing sanitizers that parse content as HTML5 (if supported) |
46 | 46 |
|
47 | 47 | The following aliases are maintained for backwards compatibility:
|
48 | 48 |
|
@@ -187,6 +187,7 @@ html_fragment = Loofah.fragment('<a><span>text</span></a>')
|
187 | 187 | html_fragment.scrub!(scrubber)
|
188 | 188 | html_fragment.to_s # => "<a></a>"
|
189 | 189 | ```
|
| 190 | + |
190 | 191 | #### Custom Scrubbers
|
191 | 192 |
|
192 | 193 | You can also create custom scrubbers in your application if you want to.
|
@@ -250,9 +251,7 @@ See [CONTRIBUTING](CONTRIBUTING.md).
|
250 | 251 |
|
251 | 252 | ### Security reports
|
252 | 253 |
|
253 |
| -Trying to report a possible security vulnerability in this project? Please |
254 |
| -check out our [security policy](https://rubyonrails.org/security) for |
255 |
| -guidelines about how to proceed. |
| 254 | +Trying to report a possible security vulnerability in this project? Please check out the [Rails project's security policy](https://rubyonrails.org/security) for instructions. |
256 | 255 |
|
257 | 256 |
|
258 | 257 | ## License
|
|
0 commit comments