From 36bd441c6a9505b11e122e391705343c187c1c9b Mon Sep 17 00:00:00 2001 From: Paul Mesnilgrente Date: Mon, 25 Jan 2021 23:30:03 +0100 Subject: [PATCH 1/3] add a note for whitelisted tags by default in the TargetScrubber --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index b3e9fb0..a8643b7 100644 --- a/README.md +++ b/README.md @@ -83,6 +83,8 @@ html_fragment.to_s # => "" Where `PermitScrubber` picks out tags and attributes to permit in sanitization, `Rails::Html::TargetScrubber` targets them for removal. +**Note:** by default, it will scrub anything that is not part of the whitelisted tags from +loofah `HTML5::Scrub.allowed_element?`. ```ruby scrubber = Rails::Html::TargetScrubber.new From f0c061df208ad8aa9eed4fbb2c92c8c47ce98817 Mon Sep 17 00:00:00 2001 From: Paul Mesnilgrente Date: Sun, 31 Jan 2021 21:10:54 +0100 Subject: [PATCH 2/3] reword the whitelisted to permitted Co-authored-by: Kasper Timm Hansen --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a8643b7..47189c9 100644 --- a/README.md +++ b/README.md @@ -83,7 +83,7 @@ html_fragment.to_s # => "" Where `PermitScrubber` picks out tags and attributes to permit in sanitization, `Rails::Html::TargetScrubber` targets them for removal. -**Note:** by default, it will scrub anything that is not part of the whitelisted tags from +**Note:** by default, it will scrub anything that is not part of the permitted tags from loofah `HTML5::Scrub.allowed_element?`. ```ruby From 27617e372a4721f76fb08199bbdf1ef6c3889c5e Mon Sep 17 00:00:00 2001 From: Paul Mesnilgrente Date: Sun, 31 Jan 2021 21:12:38 +0100 Subject: [PATCH 3/3] added the permitted tag list to the README --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 47189c9..7b160b5 100644 --- a/README.md +++ b/README.md @@ -81,7 +81,7 @@ html_fragment.to_s # => "" #### `Rails::Html::TargetScrubber` Where `PermitScrubber` picks out tags and attributes to permit in sanitization, -`Rails::Html::TargetScrubber` targets them for removal. +`Rails::Html::TargetScrubber` targets them for removal. See https://github.com/flavorjones/loofah/blob/main/lib/loofah/html5/safelist.rb for the tag list. **Note:** by default, it will scrub anything that is not part of the permitted tags from loofah `HTML5::Scrub.allowed_element?`.