module TrustHtml
Constants
- HTML_DEFS_PATH
- HTML_SANITIZER_PATH
- ID_SANITIZER_METHOD_BODY
Test every ID to make sure it does not conflict (or just remove them all) etc.
'id' is local to the method
- URL_SANITIZER_METHOD_BODY
Test every URL in the HTML to make sure it is of a specific structure. As in, make sure it is all on your domain, or all HTTPS, etc.
Example of forcing HTTPS "if((new RegExp(\"^(https)?:\/\/\", \"ig\")).test(url)) { return url; }" + 'url' is local to the method
Make sure the URL is at minimum a URL (and not JS)…
Public Class Methods
sanitize(html_to_sanitize)
click to toggle source
# File lib/trust_html/sanitizer.rb, line 23 def self.sanitize(html_to_sanitize) sanitizer_js = "function urlX(url) {#{URL_SANITIZER_METHOD_BODY}};" + "function idX(id) {#{ID_SANITIZER_METHOD_BODY}};" + # Look at #escape_javascript as well... # http://rails.rubyonrails.org/classes/ActionView/Helpers/JavaScriptHelper.html#M002239 "html_sanitize('#{html_to_sanitize.escape_single_quotes.remove_nonprintable}', urlX, idX);" cxt = V8::Context.new cxt.load(HTML_DEFS_PATH) cxt.load(HTML_SANITIZER_PATH) cxt.eval(sanitizer_js) end