Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
张重言
rails
提交
08fe700e
R
rails
项目概览
张重言
/
rails
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
R
rails
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
08fe700e
编写于
1月 20, 2015
作者:
R
Rafael Mendonça França
浏览文件
操作
浏览文件
下载
差异文件
Merge pull request #18557 from tjschuck/sanitize_doc_fixes
SanitizeHelper documentation formatting fixes + rewrite
上级
b06b1d16
2a68b470
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
51 addition
and
76 deletion
+51
-76
actionview/lib/action_view/helpers/sanitize_helper.rb
actionview/lib/action_view/helpers/sanitize_helper.rb
+51
-76
未找到文件。
actionview/lib/action_view/helpers/sanitize_helper.rb
浏览文件 @
08fe700e
...
...
@@ -8,76 +8,77 @@ module Helpers
# These helper methods extend Action View making them callable within your template files.
module
SanitizeHelper
extend
ActiveSupport
::
Concern
# This +sanitize+ helper will HTML encode all tags and strip all attributes that
# aren't specifically allowed.
# Sanitizes HTML input, stripping all tags and attributes that aren't whitelisted.
#
# It also strips href/src tags with invalid protocols, like javascript: especially.
# It does its best to counter any tricks that hackers may use, like throwing in
# unicode/ascii/hex values to get past the javascript: filters. Check out
# the extensive test suite.
# It also strips href/src attributes with unsafe protocols like
# <tt>javascript:</tt>, while also protecting against attempts to use Unicode,
# ASCII, and hex character references to work around these protocol filters.
#
# <%= sanitize @article.body %>
# The default sanitizer is Rails::Html::WhiteListSanitizer. See {Rails HTML
# Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
#
# You can add or remove tags/attributes if you want to customize it a bit.
# See ActionView::Base for full docs on the available options. You can add
# tags/attributes for single uses of +sanitize+ by passing either the
# <tt>:attributes</tt> or <tt>:tags</tt> options:
# Custom sanitization rules can also be provided.
#
#
Normal Us
e
#
#
<%= sanitize @article.body %>
#
Please note that sanitizing user-provided text does not guarantee that th
e
#
resulting markup is valid or even well-formed. For example, the output may still
#
contain unescaped characters like <tt><</tt>, <tt>></tt>, or <tt>&</tt>.
#
# Custom Use - Custom Scrubber
# (supply a Loofah::Scrubber that does the sanitization)
# ==== Options
#
# scrubber can either wrap a block:
# scrubber = Loofah::Scrubber.new do |node|
# node.text = "dawn of cats"
# end
# * <tt>:tags</tt> - An array of allowed tags.
# * <tt>:attributes</tt> - An array of allowed attributes.
# * <tt>:scrubber</tt> - A {Rails::Html scrubber}[https://github.com/rails/rails-html-sanitizer]
# or {Loofah::Scrubber}[https://github.com/flavorjones/loofah] object that
# defines custom sanitization rules. A custom scrubber takes precedence over
# custom tags and attributes.
#
# or be a subclass of Loofah::Scrubber which responds to scrub:
# class KittyApocalypse < Loofah::Scrubber
# def scrub(node)
# node.text = "dawn of cats"
# end
# end
# scrubber = KittyApocalypse.new
# ==== Examples
#
#
<%= sanitize @article.body, scrubber: scrubber %>
#
Normal use:
#
# A custom scrubber takes precedence over custom tags and attributes
# Learn more about scrubbers here: https://github.com/flavorjones/loofah
# <%= sanitize @comment.body %>
#
# Custom Use - tags and attributes
# (only the mentioned tags and attributes are allowed, nothing else)
# Providing custom whitelisted tags and attributes:
#
# <%= sanitize @
article.body, tags: %w(table tr td), attributes: %w(id class style
) %>
# <%= sanitize @
comment.body, tags: %w(strong em a), attributes: %w(href
) %>
#
#
Add table tags to the default allowed tags
#
Providing a custom Rails::Html scrubber:
#
# class Application < Rails::Application
# config.action_view.sanitized_allowed_tags = ['table', 'tr', 'td']
# end
# class CommentScrubber < Rails::Html::PermitScrubber
# def allowed_node?(node)
# !%w(form script comment blockquote).include?(node.name)
# end
#
# Remove tags to the default allowed tags
# def skip_node?(node)
# node.text?
# end
#
# class Application < Rails::Application
# config.after_initialize do
# ActionView::Base.sanitized_allowed_tags.delete 'div'
# def scrub_attribute?(name)
# name == 'style'
# end
# end
#
# Change allowed default attributes
# <%= sanitize @comment.body, scrubber: CommentScrubber.new %>
#
# See {Rails HTML Sanitizer}[https://github.com/rails/rails-html-sanitizer] for
# documentation about Rails::Html scrubbers.
#
# class Application < Rails::Application
# config.action_view.sanitized_allowed_attributes = ['id', 'class', 'style']
# Providing a custom Loofah::Scrubber:
#
# scrubber = Loofah::Scrubber.new do |node|
# node.remove if node.name == 'script'
# end
#
#
Please note that sanitizing user-provided text does not guarantee that the
#
resulting markup is valid (conforming to a document type) or even well-formed.
#
The output may still contain e.g. unescaped '<', '>', '&' characters and
#
confuse browser
s.
#
<%= sanitize @comment.body, scrubber: scrubber %>
#
#
See {Loofah's documentation}[https://github.com/flavorjones/loofah] for more
#
information about defining custom Loofah::Scrubber object
s.
#
# To set the default allowed tags or attributes across your application:
#
# # In config/application.rb
# config.action_view.sanitized_allowed_tags = ['strong', 'em', 'a']
# config.action_view.sanitized_allowed_attributes = ['href', 'title']
def
sanitize
(
html
,
options
=
{})
self
.
class
.
white_list_sanitizer
.
sanitize
(
html
,
options
).
try
(
:html_safe
)
end
...
...
@@ -87,9 +88,7 @@ def sanitize_css(style)
self
.
class
.
white_list_sanitizer
.
sanitize_css
(
style
)
end
# Strips all HTML tags from the +html+, including comments. This uses
# Nokogiri for tokenization (via Loofah) and so its HTML parsing ability
# is limited by that of Nokogiri.
# Strips all HTML tags from +html+, including comments.
#
# strip_tags("Strip <i>these</i> tags!")
# # => Strip these tags!
...
...
@@ -103,7 +102,7 @@ def strip_tags(html)
self
.
class
.
full_sanitizer
.
sanitize
(
html
)
end
# Strips all link tags from +
text
+ leaving just the link text.
# Strips all link tags from +
html
+ leaving just the link text.
#
# strip_links('<a href="http://www.rubyonrails.org">Ruby on Rails</a>')
# # => Ruby on Rails
...
...
@@ -166,30 +165,6 @@ def link_sanitizer
def
white_list_sanitizer
@white_list_sanitizer
||=
sanitizer_vendor
.
white_list_sanitizer
.
new
end
##
# :method: sanitized_allowed_tags=
#
# :call-seq: sanitized_allowed_tags=(tags)
#
# Replaces the allowed tags for the +sanitize+ helper.
#
# class Application < Rails::Application
# config.action_view.sanitized_allowed_tags = ['table', 'tr', 'td']
# end
#
##
# :method: sanitized_allowed_attributes=
#
# :call-seq: sanitized_allowed_attributes=(attributes)
#
# Replaces the allowed HTML attributes for the +sanitize+ helper.
#
# class Application < Rails::Application
# config.action_view.sanitized_allowed_attributes = ['onclick', 'longdesc']
# end
#
end
end
end
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录