diff --git a/actionview/lib/action_view/helpers/sanitize_helper.rb b/actionview/lib/action_view/helpers/sanitize_helper.rb index 8724e04d56..3035c320f3 100644 --- a/actionview/lib/action_view/helpers/sanitize_helper.rb +++ b/actionview/lib/action_view/helpers/sanitize_helper.rb @@ -129,11 +129,11 @@ module ActionView end def sanitized_allowed_tags - safe_list_sanitizer.allowed_tags + sanitizer_vendor.safe_list_sanitizer.allowed_tags end def sanitized_allowed_attributes - safe_list_sanitizer.allowed_attributes + sanitizer_vendor.safe_list_sanitizer.allowed_attributes end # Gets the Rails::Html::FullSanitizer instance used by +strip_tags+. Replace with diff --git a/actionview/test/template/sanitize_helper_test.rb b/actionview/test/template/sanitize_helper_test.rb index 181f09ab65..4a2a21996b 100644 --- a/actionview/test/template/sanitize_helper_test.rb +++ b/actionview/test/template/sanitize_helper_test.rb @@ -40,4 +40,17 @@ class SanitizeHelperTest < ActionView::TestCase def test_sanitize_is_marked_safe assert_predicate sanitize(""), :html_safe? end + + def test_sanitized_allowed_tags_class_method + expected = Set.new(["strong", "em", "b", "i", "p", "code", "pre", "tt", "samp", "kbd", "var", + "sub", "sup", "dfn", "cite", "big", "small", "address", "hr", "br", "div", "span", "h1", "h2", + "h3", "h4", "h5", "h6", "ul", "ol", "li", "dl", "dt", "dd", "abbr", "acronym", "a", "img", + "blockquote", "del", "ins"]) + assert_equal(expected, self.class.sanitized_allowed_tags) + end + + def test_sanitized_allowed_attributes_class_method + expected = Set.new(["href", "src", "width", "height", "alt", "cite", "datetime", "title", "class", "name", "xml:lang", "abbr"]) + assert_equal(expected, self.class.sanitized_allowed_attributes) + end end