loofah version 0.3.0 has been released!
Loofah is an HTML sanitizer. It will always fix broken markup, but
can also sanitize unsafe tags in a few different ways, and transform
the markup for storage or display.
It’s built on top of Nokogiri and libxml2, so it’s fast. And it uses
html5lib’s whitelist, so it most likely won’t make your codes less
- These statements have not been evaluated by Netexperts.
New ActiveRecord extension
xss_foliate, a drop-in replacement for xss_terminate.
Replacement methods for ActionView’s helper methods
Official support (and test coverage) for Rails versions 2.3, 2.2, 2.1, 2.0 and 1.2.
- The methods strip_tags, whitewash, whitewash_document, sanitize, and
sanitize_document have been deprecated. See DEPRECATED.rdoc for
details on the equivalent calls with the post-0.2 API.
Strip unsafe tags, leaving behind only the inner text.
Prune unsafe tags and their subtrees, removing all traces that they ever existed.
Escape unsafe tags and their subtrees, leaving behind lots of < and > entities.
Whitewash the markup, removing all attributes and namespaced nodes.
Format the markup as plain text.
Two ActiveRecord extensions:
An opt-out sanitizer that sanitizes all models and attributes by default
(it’s also an XssTerminate drop-in replacement).
- An opt-in sanitizer which sanitized the attributes you
explicitly declare to be sanitized.
99 44/100 % pure
Performance compares favorably with similar libraries: http://gist.github.com/170193