Are there any better alternatives to Sanitize for a Ruby app?

Question

I love Sanitize. It's an amazing utility. The only issue I have w/ it is the fact that it takes forever to prepare a development environment w/ it because it uses Nokogiri, which is a pain for compile time. Are there any programs that do what Sanitize does (if nothing else than mildly what it does) w/out using Nokogiri? This would help exponentially!

Answer 1

Rails has its own SanitizeHelper.

According to http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html, it will

This sanitize helper will html encode all tags and strip all attributes that aren’t specifically allowed.

It also strips href/src tags with invalid protocols, like javascript: especially. It does its best to counter any tricks that hackers may use, like throwing in unicode/ascii/hex values to get past the javascript: filters. Check out the extensive test suite.

You can use it in a view like so

<%= sanitize @article.body %>

You can visit the link to see more customizing options like:

Custom Use (only the mentioned tags and attributes are allowed, nothing else)

<%= sanitize @article.body, tags: %w(table tr td), attributes: %w(id class style) %>