Class: Pressroom::Blocks::Sanitizer

Inherits:
Object
  • Object
show all
Defined in:
lib/pressroom/blocks/sanitizer.rb

Overview

Allow-list sanitizer applied to every field the schema marks as html.

This is the single trust boundary between editor output and rendered pages. Everything else is escaped by ERB.

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(tags:, attributes:) ⇒ Sanitizer

Returns a new instance of Sanitizer.



22
23
24
25
26
 
# File 'lib/pressroom/blocks/sanitizer.rb', line 22

def initialize(tags:, attributes:)
  @tags = tags
  @attributes = attributes
  @backend = self.class.backend_class.new
end

Class Method Details

.backend_class ⇒ Object 



13
14
15
16
17
18
19
20
 
# File 'lib/pressroom/blocks/sanitizer.rb', line 13

def self.backend_class
  if Rails::HTML::Sanitizer.respond_to?(:html5_support?) &&
     Rails::HTML::Sanitizer.html5_support?
    Rails::HTML5::SafeListSanitizer
  else
    Rails::HTML4::SafeListSanitizer
  end
end

Instance Method Details

#sanitize(value) ⇒ Object 



28
29
30
31
32
33
 
# File 'lib/pressroom/blocks/sanitizer.rb', line 28

def sanitize(value)
  return "".html_safe if value.nil?

  @backend.sanitize(value.to_s, tags: @tags, attributes: @attributes)
          .to_s.html_safe
end