ActionView::Helpers::SanitizeHelper

sanitize

def sanitize(html, options = {})

Description

Returns the HTML with disallowed tags and attributes removed.

Arguments

Changing a value updates the ERB and HTML.

html

"<b onclick=\"x()\">Fish</b> <script>alert(1)</script> <a href=\"javascript:x\">link</a>"

"<i style=\"color: red; position: fixed\" title=\"t\">Chips</i>"

Removes what is not in the allow list, as follows:

Tags: removed, keeping their content. Comments are removed too.
HTML attributes: removed. href attributes that start with javascript: or similar are removed too.
The style attribute: not in the allow list, so it is removed by default. When it is allowed with :attributes, removes disallowed CSS declarations from it, as sanitize_css does (if all of them are removed, style="" remains).

The allow list is the allowed_tags and allowed_attributes of Rails::HTML5::SafeListSanitizer (configurable with config.action_view.sanitized_allowed_tags and sanitized_allowed_attributes).

options= {}

:tags = the allow list

%w[i]

Keeps only the given tags, replacing the allow list. Pass an array of strings (symbols do not match).

:attributes = the allow list

%w[style]

Keeps only the given HTML attributes, replacing the allow list. Pass an array of strings (symbols do not match).

Of the other options, only :scrubber is used: the given scrubber (a Loofah scrubber) decides what to remove, replacing the allow list. The rest are ignored.

ERB

Changes from the previous output: Added Removed Changed

HTML

Preview

Form submission

Form data

name	value

Request body

Content-Type:

params