Issues - rgrove/sanitize

rgrove / sanitize

230

Description:

Whitelist-based Ruby HTML sanitizer.

Sort by: Priority | Votes | Last Updated

Loading…

1.

1 vote

enhancement
x

Add option to escape non-whitelisted elements instead of stripping them
2 comments Created 2 months ago by rgrove

Title

Body
Feature request from Ævar Arnfjörð Bjarmason: > My use case is that I'm calling Sanitize like this: > > def clean(html) > return Sanitize.clean(html, :elements => ['a'], > :attributes => {'a' => ['href']}, > :protocols => {'a' => {'href' => ['http', 'https']}}) > end > > And this is the output I really want: > > clean("") ==> > clean("<a href=\"http://example.com\">example</a>") ==> <a href="http://example.com">example</a> > > Instead Sanitize will comptetely strip the unacceptable HTML tag. We should implement a setting to make the stripping optional.
or cancel
Feature request from Ævar Arnfjörð Bjarmason:
My use case is that I'm calling Sanitize like this:
```
def clean(html)
 return Sanitize.clean(html, :elements => ['a'],
 :attributes => {'a' => ['href']},
 :protocols => {'a' => {'href' => ['http', 'https']}})
end
```
And this is the output I really want:
```
clean("") ==> &lt;b&gt;
clean("<a href=\"http://example.com\">example</a>") ==> &lt;b&gt;<a href="http://example.com">example</a>
```
Instead Sanitize will comptetely strip the unacceptable HTML tag.
We should implement a setting to make the stripping optional.
Comments

rgrove Thu Sep 17 12:35:18 -0700 2009 | link

Turns out this is likely to be quite a bit more complicated to implement than I originally thought, unless we escape the tag and all of its contents, regardless of whether the contents include legal tags.

This is going to take some more thought.

Comment
Turns out this is likely to be quite a bit more complicated to implement than I originally thought, unless we escape the tag *and* all of its contents, regardless of whether the contents include legal tags. This is going to take some more thought.
or cancel

cluesque Thu Oct 29 19:01:16 -0700 2009 | link

+1 .. my example is simpler:

clean("a < b") ==> "a < b"

Comment
+1 .. my example is simpler: clean("a < b") ==> "a &lt; b"
or cancel

Parsed with GitHub Flavored Markdown

Labels

enhancementx Add option to escape non-whitelisted elements instead of stripping them

Comments

enhancement
x

Add option to escape non-whitelisted elements instead of stripping them