Safe way to show only link from user post

Question

I'm trying to permit to users to post links in their posts. I use auto_link gem.

Is it safe in this way from xss and other attacks?

def show_content(content_with_links)
    auto_link (sanitize content_with_links.join(" "), tags: %w(a))
end

Answer 1

According to the README, it is protected from malicious scripts:

auto_link("Go to http://www.rubyonrails.org <script>Malicious code!</script>")
# => "Go to <a href=\"http://www.rubyonrails.org\">http://www.rubyonrails.org</a> "