Class: Qti::Sanitizer

Inherits:
Object
  • Object
show all
Defined in:
lib/qti/sanitizer.rb

Constant Summary collapse

ELEMENTS_REMAP = 
{
  'prompt' => 'div',
  'simpleBlock' => 'div',
  'simpleInline' => 'span',
  'atomicBlock' => 'div',
  'atomicInline' => 'span'
}.freeze
PROTOCOLS = 
['http', 'https', :relative].freeze
FILTER_TAGS = 
%w[iframe object embed video audio source].freeze
ALL_DATA_ATTR = 
[:data].freeze
MEDIA_SRC_ATTR = 
%w[src data type codebase].freeze
MEDIA_FMT_ATTR = 
%w[width height classid].freeze
MEDIA_ALT_ATTR = 
%w[title alt allow allowfullscreen].freeze
MEDIA_ATTR = 
[MEDIA_SRC_ATTR, MEDIA_FMT_ATTR, MEDIA_ALT_ATTR, ALL_DATA_ATTR].flatten.freeze
CONFIG = 
{
  elements: Sanitize::Config::RELAXED[:elements] + FILTER_TAGS,
  protocols:
    {
      'iframe' => { 'src' => PROTOCOLS },
      'object' => { 'src' => PROTOCOLS, 'data' => PROTOCOLS },
      'embed' => { 'src' => PROTOCOLS },
      'video' => { 'src' => PROTOCOLS },
      'audio' => { 'src' => PROTOCOLS },
      'source' => { 'src' => PROTOCOLS }
    },
  attributes:
    {
      'video' => MEDIA_ATTR,
      'audio' => MEDIA_ATTR,
      'source' => MEDIA_ATTR,
      'object' => MEDIA_ATTR,
      'embed' => %w[name src type allowfullscreen pluginspage wmode
                    allowscriptaccess width height],
      'iframe' => %w[src style width height name align frameborder scrolling sandbox
                     allowfullscreen webkitallowfullscreen mozallowfullscreen
                     allow] + ALL_DATA_ATTR, # TODO: remove explicit allow with domain whitelist account setting
      'a' => relaxed_config('a', ['target'] + ALL_DATA_ATTR),
      'img' => relaxed_config('img', ALL_DATA_ATTR)
    }
}.freeze

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.relaxed_config(element, overrides) ⇒ Object 



19
20
21
 
# File 'lib/qti/sanitizer.rb', line 19

def self.relaxed_config(element, overrides)
  Sanitize::Config::RELAXED[:attributes][element] + overrides
end

Instance Method Details

#clean(html) ⇒ Object 



51
52
53
 
# File 'lib/qti/sanitizer.rb', line 51

def clean(html)
  Sanitize.fragment(html, sanitize_config)
end