Module: HtmlSafe

Included in:
TextLine
Defined in:
lib/almirah/html_safe.rb

Overview

Shared HTML output-encoding helpers (ADR-188, SRS-096/097/098).

Author-written Markdown is untrusted text and must be encoded for its HTML context at the point of output. These helpers are the single mechanism every renderer routes through, so coverage cannot drift item-by-item the way it did when only inline code and wiki-link text were escaped.

Constant Summary collapse

ALLOWED_URL_SCHEMES =

URL schemes permitted in link/image targets. Anything else (notably javascript:, data:, vbscript:) is treated as unsafe and rendered inert.

%w[http https mailto].freeze

Instance Method Summary collapse

Instance Method Details

#escape_attr(str) ⇒ Object

Escapes a value interpolated into a quoted HTML attribute so it cannot terminate the attribute or introduce new attributes/elements. SRS-097.



25
26
27
 
# File 'lib/almirah/html_safe.rb', line 25

def escape_attr(str)
  CGI.escapeHTML(str.to_s)
end

#escape_text(str) ⇒ Object

Escapes literal text rendered into element content (the five characters: & < > “ ‘). Used for paragraph, heading, blockquote, table-cell and fenced code block text. SRS-096.



19
20
21
 
# File 'lib/almirah/html_safe.rb', line 19

def escape_text(str)
  CGI.escapeHTML(str.to_s)
end

#safe_url(raw) ⇒ Object

Returns the URL when it is a relative/anchor reference or carries an allowed scheme; returns nil for any other scheme so the caller can render the link/image inert. SRS-098.



32
33
34
35
36
37
38
 
# File 'lib/almirah/html_safe.rb', line 32

def safe_url(raw)
  url = raw.to_s.strip
  scheme = url[/\A([a-z][a-z0-9+.-]*):/i, 1]
  return url if scheme.nil? # relative path or anchor reference

  ALLOWED_URL_SCHEMES.include?(scheme.downcase) ? url : nil
end