Class: HTML::WhiteListSanitizer

### Home Classes Methods

### In Files

- lib/action_controller/vendor/html-scanner/html/sanitizer.rb

### Parent

HTML::Sanitizer

### Methods

- #contains_bad_protocols?
- #process_attributes_for
- #process_node
- #sanitize_css
- #tokenize

### Class/Module Index

Quicksearch

- ActionDispatch
- ActionDispatch::Assertions
- ActionDispatch::Assertions::DomAssertions
- ActionDispatch::Assertions::ResponseAssertions
- ActionDispatch::Assertions::RoutingAssertions
- ActionDispatch::Assertions::SelectorAssertions
- ActionDispatch::Assertions::TagAssertions
- ActionDispatch::BestStandardsSupport
- ActionDispatch::BodyProxy
- ActionDispatch::Callbacks
- ActionDispatch::Cookies
- ActionDispatch::Cookies::CookieOverflow
- ActionDispatch::DebugExceptions
- ActionDispatch::ExceptionWrapper
- ActionDispatch::FileHandler
- ActionDispatch::Flash
- ActionDispatch::Flash::FlashHash
- ActionDispatch::Head
- ActionDispatch::Http
- ActionDispatch::Http::Cache
- ActionDispatch::Http::Cache::Request
- ActionDispatch::Http::Cache::Response
- ActionDispatch::Http::FilterParameters
- ActionDispatch::Http::Headers
- ActionDispatch::Http::MimeNegotiation
- ActionDispatch::Http::ParameterFilter
- ActionDispatch::Http::Parameters
- ActionDispatch::Http::URL
- ActionDispatch::Http::Upload
- ActionDispatch::Http::UploadedFile
- ActionDispatch::Integration
- ActionDispatch::Integration::RequestHelpers
- ActionDispatch::Integration::Runner
- ActionDispatch::Integration::Session
- ActionDispatch::IntegrationTest
- ActionDispatch::MiddlewareStack
- ActionDispatch::MiddlewareStack::Middleware
- ActionDispatch::ParamsParser
- ActionDispatch::PerformanceTest
- ActionDispatch::PublicExceptions
- ActionDispatch::RailsEntityStore
- ActionDispatch::RailsMetaStore
- ActionDispatch::Railtie
- ActionDispatch::Reloader
- ActionDispatch::RemoteIp
- ActionDispatch::RemoteIp::GetIp
- ActionDispatch::RemoteIp::IpSpoofAttackError
- ActionDispatch::Request
- ActionDispatch::RequestId
- ActionDispatch::Rescue
- ActionDispatch::Response
- ActionDispatch::Routing
- ActionDispatch::Routing::Mapper
- ActionDispatch::Routing::Mapper::Base
- ActionDispatch::Routing::Mapper::HttpHelpers
- ActionDispatch::Routing::Mapper::Resources
- ActionDispatch::Routing::Mapper::Scoping
- ActionDispatch::Routing::PolymorphicRoutes
- ActionDispatch::Routing::Redirection
- ActionDispatch::Routing::RouteSet
- ActionDispatch::Routing::RouteSet::MountedHelpers
- ActionDispatch::Routing::UrlFor
- ActionDispatch::Session
- ActionDispatch::Session::AbstractStore
- ActionDispatch::Session::CacheStore
- ActionDispatch::Session::Compatibility
- ActionDispatch::Session::CookieStore
- ActionDispatch::Session::DestroyableSession
- ActionDispatch::Session::MemCacheStore
- ActionDispatch::Session::StaleSessionCheck
- ActionDispatch::ShowExceptions
- ActionDispatch::Static
- ActionDispatch::TestProcess
- ActionDispatch::TestRequest
- ActionDispatch::TestResponse
- ActionController
- ActionController::Base
- ActionController::Caching
- ActionController::Caching::Actions
- ActionController::Caching::Actions::ActionCachePath
- ActionController::Caching::Actions::ClassMethods
- ActionController::Caching::ConfigMethods
- ActionController::Caching::Fragments
- ActionController::Caching::Pages
- ActionController::Caching::Pages::ClassMethods
- ActionController::Caching::Sweeping
- ActionController::Compatibility
- ActionController::ConditionalGet
- ActionController::Cookies
- ActionController::DataStreaming
- ActionController::Flash
- ActionController::ForceSSL
- ActionController::ForceSSL::ClassMethods
- ActionController::Head
- ActionController::Helpers
- ActionController::Helpers::ClassMethods
- ActionController::HideActions
- ActionController::HideActions::ClassMethods
- ActionController::HttpAuthentication
- ActionController::HttpAuthentication::Basic
- ActionController::HttpAuthentication::Basic::ControllerMethods
- ActionController::HttpAuthentication::Basic::ControllerMethods::ClassMethods
- ActionController::HttpAuthentication::Digest
- ActionController::HttpAuthentication::Digest::ControllerMethods
- ActionController::HttpAuthentication::Token
- ActionController::HttpAuthentication::Token::ControllerMethods
- ActionController::ImplicitRender
- ActionController::Instrumentation
- ActionController::Instrumentation::ClassMethods
- ActionController::LogSubscriber
- ActionController::Metal
- ActionController::Middleware
- ActionController::Middleware::ActionMiddleware
- ActionController::MimeResponds
- ActionController::MimeResponds::ClassMethods
- ActionController::ParamsWrapper
- ActionController::ParamsWrapper::ClassMethods
- ActionController::RackDelegation
- ActionController::Railtie
- ActionController::Railties
- ActionController::Railties::Paths
- ActionController::RecordIdentifier
- ActionController::Redirecting
- ActionController::Renderers
- ActionController::Renderers::All
- ActionController::Renderers::ClassMethods
- ActionController::Rendering
- ActionController::RequestForgeryProtection
- ActionController::RequestForgeryProtection::ClassMethods
- ActionController::Rescue
- ActionController::Responder
- ActionController::SessionManagement
- ActionController::SessionManagement::ClassMethods
- ActionController::Streaming
- ActionController::TemplateAssertions
- ActionController::TestCase
- ActionController::TestCase::Behavior
- ActionController::TestCase::Behavior::ClassMethods
- ActionController::TestCase::RaiseActionExceptions
- ActionController::TestResponse
- ActionController::Testing
- ActionController::Testing::ClassMethods
- ActionController::UrlFor
- ActionView
- ActionView::Base
- ActionView::Context
- ActionView::FileSystemResolver
- ActionView::FixtureResolver
- ActionView::Helpers
- ActionView::Helpers::ActiveModelHelper
- ActionView::Helpers::ActiveModelInstanceTag
- ActionView::Helpers::AssetPaths
- ActionView::Helpers::AssetTagHelper
- ActionView::Helpers::AssetTagHelper::AssetIncludeTag
- ActionView::Helpers::AssetTagHelper::JavascriptIncludeTag
- ActionView::Helpers::AssetTagHelper::JavascriptTagHelpers
- ActionView::Helpers::AssetTagHelper::JavascriptTagHelpers::ClassMethods
- ActionView::Helpers::AssetTagHelper::StylesheetIncludeTag
- ActionView::Helpers::AssetTagHelper::StylesheetTagHelpers
- ActionView::Helpers::AssetTagHelper::StylesheetTagHelpers::ClassMethods
- ActionView::Helpers::AtomFeedHelper
- ActionView::Helpers::AtomFeedHelper::AtomBuilder
- ActionView::Helpers::AtomFeedHelper::AtomFeedBuilder
- ActionView::Helpers::CacheHelper
- ActionView::Helpers::CaptureHelper
- ActionView::Helpers::CsrfHelper
- ActionView::Helpers::DateHelper
- ActionView::Helpers::DateHelperInstanceTag
- ActionView::Helpers::DebugHelper
- ActionView::Helpers::FormBuilder
- ActionView::Helpers::FormHelper
- ActionView::Helpers::FormOptionsHelper
- ActionView::Helpers::FormTagHelper
- ActionView::Helpers::InstanceTag
- ActionView::Helpers::JavaScriptHelper
- ActionView::Helpers::OutputSafetyHelper
- ActionView::Helpers::RecordTagHelper
- ActionView::Helpers::RenderingHelper
- ActionView::Helpers::SanitizeHelper
- ActionView::Helpers::TagHelper
- ActionView::Helpers::TextHelper
- ActionView::Helpers::TranslationHelper
- ActionView::Helpers::UrlHelper
- ActionView::LogSubscriber
- ActionView::LookupContext
- ActionView::LookupContext::DetailsCache
- ActionView::LookupContext::ViewPaths
- ActionView::NullResolver
- ActionView::PartialRenderer
- ActionView::Railtie
- ActionView::Renderer
- ActionView::Resolver
- ActionView::Resolver::Path
- ActionView::Template
- ActionView::Template::Handlers
- ActionView::Template::Handlers::Builder
- ActionView::Template::Handlers::ERB
- ActionView::Template::Handlers::Erubis
- ActionView::TestCase
- ActionView::TestCase::Behavior
- ActionView::TestCase::Behavior::ClassMethods
- ActionView::TestCase::Behavior::Locals
- ActionView::TestCase::TestController
- AbstractController
- AbstractController::ActionNotFound
- AbstractController::AssetPaths
- AbstractController::Base
- AbstractController::Callbacks
- AbstractController::Callbacks::ClassMethods
- AbstractController::Collector
- AbstractController::DoubleRenderError
- AbstractController::Error
- AbstractController::Helpers
- AbstractController::Helpers::ClassMethods
- AbstractController::Layouts
- AbstractController::Layouts::ClassMethods
- AbstractController::Layouts::ClassMethods::LayoutConditions
- AbstractController::Logger
- AbstractController::Railties
- AbstractController::Railties::RoutesHelpers
- AbstractController::Rendering
- AbstractController::Rendering::ClassMethods
- AbstractController::Translation
- AbstractController::UrlFor
- AbstractController::UrlFor::ClassMethods
- AbstractController::ViewPaths
- AbstractController::ViewPaths::ClassMethods
- Sprockets
- Sprockets::Bootstrap
- Sprockets::Compressors
- Sprockets::Helpers
- Sprockets::Helpers::IsolatedHelper
- Sprockets::Helpers::RailsHelper
- Sprockets::Helpers::RailsHelper::AssetPaths
- Sprockets::Helpers::RailsHelper::AssetPaths::AssetNotPrecompiledError
- Sprockets::Railtie
- Sprockets::StaticCompiler
- HTML
- HTML::FullSanitizer
- HTML::LinkSanitizer
- HTML::Sanitizer
- HTML::Selector
- HTML::Tag
- HTML::WhiteListSanitizer
- Mime
- Mime::Mimes
- Mime::Type
- ActionPack
- Object
- Rack

No matching classes.

# HTML::WhiteListSanitizer

### Public Instance Methods

sanitize_css(style) click to toggle source

Sanitizes a block of css code. Used by sanitize when it comes across a style attribute

    # File lib/action_controller/vendor/html-scanner/html/sanitizer.rb, line 108
    def sanitize_css(style)
      # disallow urls
      style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ')

      # gauntlet
      if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ ||
          style !~ /\A(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*\z/
        return ''
      end

      clean = []
      style.scan(/([-\w]+)\s*:\s*([^:;]*)/) do |prop,val|
        if allowed_css_properties.include?(prop.downcase)
          clean <<  prop + ': ' + val + ';'
        elsif shorthand_css_properties.include?(prop.split('-')[0].downcase)
          unless val.split().any? do |keyword|
            !allowed_css_keywords.include?(keyword) &&
              keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
          end
            clean << prop + ': ' + val + ';'
          end
        end
      end
      clean.join(' ')
    end

### Protected Instance Methods

contains_bad_protocols?(attr_name, value) click to toggle source

    # File lib/action_controller/vendor/html-scanner/html/sanitizer.rb, line 172
    def contains_bad_protocols?(attr_name, value)
      uri_attributes.include?(attr_name) &&
      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
    end

process_attributes_for(node, options) click to toggle source

    # File lib/action_controller/vendor/html-scanner/html/sanitizer.rb, line 159
    def process_attributes_for(node, options)
      return unless node.attributes
      node.attributes.keys.each do |attr_name|
        value = node.attributes[attr_name].to_s

        if !options[:attributes].include?(attr_name) || contains_bad_protocols?(attr_name, value)
          node.attributes.delete(attr_name)
        else
          node.attributes[attr_name] = attr_name == 'style' ? sanitize_css(value) : CGI::escapeHTML(CGI::unescapeHTML(value))
        end
      end
    end

process_node(node, result, options) click to toggle source

    # File lib/action_controller/vendor/html-scanner/html/sanitizer.rb, line 142
    def process_node(node, result, options)
      result << case node
        when HTML::Tag
          if node.closing == :close
            options[:parent].shift
          else
            options[:parent].unshift node.name
          end

          process_attributes_for node, options

          options[:tags].include?(node.name) ? node : nil
        else
          bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;")
      end
    end

tokenize(text, options) click to toggle source

    # File lib/action_controller/vendor/html-scanner/html/sanitizer.rb, line 135
    def tokenize(text, options)
      options[:parent] = []
      options[:attributes] ||= allowed_attributes
      options[:tags]       ||= allowed_tags
      super
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.