Sha256: f50d1064e8f8f0e33f45003d669915c947c44c2f5df5b3cd8dd2c21065d743f6
Contents?: true
Size: 928 Bytes
Versions: 42
Compression:
Stored size: 928 Bytes
Contents
# frozen_string_literal: true
module Decidim
# Use this class as a scrubber to sanitize user input. The default
# scrubbed provided by Rails does not allow `iframe`s, and we're using
# them to embed videos, so we need to provide a whole new scrubber.
#
# Example:
#
# sanitize(@page.body, scrubber: Decidim::UserInputScrubber.new)
#
# Lists of default tags and attributes are extracted from
# https://stackoverflow.com/a/35073814/2110884.
class NewsletterScrubber < Rails::Html::PermitScrubber
def initialize
super
self.tags = custom_allowed_tags
self.attributes = custom_allowed_attributes
end
private
def custom_allowed_attributes
Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen) - %w(onerror)
end
def custom_allowed_tags
Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 + %w(iframe style)
end
end
end
Version data entries
42 entries across 42 versions & 1 rubygems