Module: Gourami::Plugins::Sanitize::InstanceMethods

Defined in:
lib/gourami/plugins/sanitize.rb

Instance Method Summary collapse

Instance Method Details

#coerce_sanitized_string(value, options = {}) ⇒ String?

Parameters:

  • value (Object)
  • options (Hash) (defaults to: {}) —

    forwarded to #coerce_string

Returns:

  • (String, nil) 


23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/gourami/plugins/sanitize.rb', line 23

def coerce_sanitized_string(value, options = {})
  value = coerce_string(value, options)
  return value if value.nil?

  # Unescape first so entity-encoded tags (e.g. "<script>") are
  # recognized as real HTML by Loofah instead of passing through as text.
  unescaped_content = CGI.unescapeHTML(value)
  sanitized_content = Loofah.html4_fragment(unescaped_content).scrub!(:prune).to_s
  # Unescape again since loofah would turn a & back into &
  CGI.unescapeHTML(sanitized_content).strip
end