kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Update sanitizer in ActionView::Helpers::SanitizeHelper

Browse source 
- The sanitizer has been changed to safe_list_sanitizer.
- deprecate white_list_sanitizer
This commit is contained in:
Juanito Fatas 2019-05-14 13:09:39 +09:00 committed by Kasper Timm Hansen
parent 1af44e4aee
commit 52f0b050e2
No known key found for this signature in database
GPG key ID: 191153215EDA53D8
3 changed files with 18 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actiontext/app/helpers/action_text/content_helper.rb
View file

@ -4,7 +4,7 @@ require "rails-html-sanitizer"
module ActionText
module ContentHelper
mattr_accessor(:sanitizer) { Rails::Html::Sanitizer.white_list_sanitizer.new }
mattr_accessor(:sanitizer) { Rails::Html::Sanitizer.safe_list_sanitizer.new }
mattr_accessor(:allowed_tags) { sanitizer.class.allowed_tags + [ ActionText::Attachment::TAG_NAME, "figure", "figcaption" ] }
mattr_accessor(:allowed_attributes) { sanitizer.class.allowed_attributes + ActionText::Attachment::ATTRIBUTES }
mattr_accessor(:scrubber)

4
actionview/CHANGELOG.md
View file

@ -1,3 +1,7 @@
* ActionView::Helpers::SanitizeHelper: support rails-html-sanitizer 1.1.0.
*Juanito Fatas*
* Added `phone_to` helper method to create a link from mobile numbers
*Pietro Moro*

34
actionview/lib/action_view/helpers/sanitize_helper.rb
View file

@ -1,6 +1,7 @@
# frozen_string_literal: true
require "rails-html-sanitizer"
require "active_support/deprecation"
module ActionView
# = Action View Sanitize Helpers
@ -16,7 +17,7 @@ module ActionView
# ASCII, and hex character references to work around these protocol filters.
# All special characters will be escaped.
#
# The default sanitizer is Rails::Html::WhiteListSanitizer. See {Rails HTML
# The default sanitizer is Rails::Html::SafeListSanitizer. See {Rails HTML
# Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
#
# Custom sanitization rules can also be provided.
@ -79,12 +80,12 @@ module ActionView
# config.action_view.sanitized_allowed_tags = ['strong', 'em', 'a']
# config.action_view.sanitized_allowed_attributes = ['href', 'title']
def sanitize(html, options = {})
self.class.white_list_sanitizer.sanitize(html, options)&.html_safe
self.class.safe_list_sanitizer.sanitize(html, options)&.html_safe
end
# Sanitizes a block of CSS code. Used by +sanitize+ when it comes across a style attribute.
def sanitize_css(style)
self.class.white_list_sanitizer.sanitize_css(style)
self.class.safe_list_sanitizer.sanitize_css(style)
end
# Strips all HTML tags from +html+, including comments and special characters.
@ -122,20 +123,14 @@ module ActionView
end
module ClassMethods #:nodoc:
attr_writer :full_sanitizer, :link_sanitizer, :white_list_sanitizer
# Vendors the full, link and white list sanitizers.
# Provided strictly for compatibility and can be removed in Rails 6.
def sanitizer_vendor
Rails::Html::Sanitizer
end
attr_writer :full_sanitizer, :link_sanitizer, :safe_list_sanitizer
def sanitized_allowed_tags
sanitizer_vendor.white_list_sanitizer.allowed_tags
safe_list_sanitizer.allowed_tags
end
def sanitized_allowed_attributes
sanitizer_vendor.white_list_sanitizer.allowed_attributes
safe_list_sanitizer.allowed_attributes
end
# Gets the Rails::Html::FullSanitizer instance used by +strip_tags+. Replace with
@ -144,9 +139,8 @@ module ActionView
# class Application < Rails::Application
# config.action_view.full_sanitizer = MySpecialSanitizer.new
# end
#
def full_sanitizer
@full_sanitizer ||= sanitizer_vendor.full_sanitizer.new
@full_sanitizer ||= Rails::Html::Sanitizer.full_sanitizer.new
end
# Gets the Rails::Html::LinkSanitizer instance used by +strip_links+.
@ -155,20 +149,18 @@ module ActionView
# class Application < Rails::Application
# config.action_view.link_sanitizer = MySpecialSanitizer.new
# end
#
def link_sanitizer
@link_sanitizer ||= sanitizer_vendor.link_sanitizer.new
@link_sanitizer ||= Rails::Html::Sanitizer.link_sanitizer.new
end
# Gets the Rails::Html::WhiteListSanitizer instance used by sanitize and +sanitize_css+.
# Gets the Rails::Html::SafeListSanitizer instance used by sanitize and +sanitize_css+.
# Replace with any object that responds to +sanitize+.
#
# class Application < Rails::Application
# config.action_view.white_list_sanitizer = MySpecialSanitizer.new
# config.action_view.safe_list_sanitizer = MySpecialSanitizer.new
# end
#
def white_list_sanitizer
@white_list_sanitizer ||= sanitizer_vendor.white_list_sanitizer.new
def safe_list_sanitizer
@safe_list_sanitizer ||= Rails::Html::Sanitizer.safe_list_sanitizer.new
end
end
end