white_list | A copy of technoweenie's white_list plugin For backwards compatibility only

white_list is a Ruby library. white_list has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

This White Listing helper will html encode all tags and strip all attributes that aren’t specifically allowed. It also strips href/src tags with invalid protocols, like javascript: especially. It does its best to counter any tricks that hackers may use, like throwing in unicode/ascii/hex values to get past the javascript: filters. Check out the extensive test suite. You can add or remove tags/attributes if you want to customize it a bit. white_list accepts a block for custom tag escaping. Shown below is the default block that white_list uses if none is given. The block is called for all bad tags, and every text node. node is an instance of HTML::Node (either HTML::Tag or HTML::Text). bad is nil for text nodes inside good tags, or is the tag name of the bad tag.