Module: Sanitize::Rails::Engine

Extended by:
Engine
Included in:
Engine
Defined in:
lib/sanitize/rails.rb

Instance Method Summary collapse

Instance Method Details

#callback_for(options) ⇒ Object

:nodoc:



63
64
65
66
67
68
69
70
71
 
# File 'lib/sanitize/rails.rb', line 63

def callback_for(options) #:nodoc:
  point = (options[:on] || 'save').to_s

  unless %w( save create ).include?(point)
    raise ArgumentError, "Invalid callback point #{point}, valid ones are :save and :create"
  end

  "before_#{point}".intern
end

#clean(string) ⇒ Object

Returns a copy of the given ‘string` after sanitizing it and marking it as `html_safe`

Ensuring this methods return instances of ActiveSupport::SafeBuffer means that text passed through ‘Sanitize::Rails::Engine.clean` will not be escaped by ActionView’s XSS filtering utilities.



53
54
55
 
# File 'lib/sanitize/rails.rb', line 53

def clean(string)
  ::ActiveSupport::SafeBuffer.new string.to_s.dup.tap { |s| clean!(s) }
end

#clean!(string) ⇒ Object

Sanitizes the given ‘string` in place and does NOT mark it as `html_safe`



59
60
61
 
# File 'lib/sanitize/rails.rb', line 59

def clean!(string)
  cleaner.clean!(string.to_s).to_s
end

#cleaner ⇒ Object

Returns a memoized instance of the Engine with the configuration passed to the configure method or with the ActionView’s default config



33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/sanitize/rails.rb', line 33

def cleaner
  @@config ||= begin
    {
      :elements   => ::ActionView::Base.sanitized_allowed_tags.to_a,
      :attributes => { :all => ::ActionView::Base.sanitized_allowed_attributes.to_a},
      :protocols  => { :all => ::ActionView::Base.sanitized_allowed_protocols.to_a }
    }
  rescue
    warn "ActionView not available, falling back to Sanitize's BASIC config"
    ::Sanitize::Config::BASIC
  end
  @sanitizer ||= ::Sanitize.new(@@config)
end

#configure(config) ⇒ Object 



25
26
27
 
# File 'lib/sanitize/rails.rb', line 25

def configure(config)
  @@config = config.freeze
end

#method_for(fields) ⇒ Object

:nodoc:



73
74
75
 
# File 'lib/sanitize/rails.rb', line 73

def method_for(fields) #:nodoc:
  "sanitize_#{fields.join('_')}".intern
end