class Autolinker::HTML::Sanitizer

Attributes

allowed_attributes[RW]
allowed_css_keywords[RW]
allowed_css_properties[RW]
allowed_protocols[RW]
allowed_tags[RW]
bad_tags[RW]
protocol_separator[RW]
shorthand_css_properties[RW]
uri_attributes[RW]

Public Class Methods

new() click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 10
def initialize
  # A regular expression of the valid characters used to separate protocols like
  # the ':' in 'http://foo.com'
  @protocol_separator = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|%)3A/i

  # Specifies a Set of HTML attributes that can have URIs.
  @uri_attributes = Set.new(%w(href src cite action longdesc xlink:href lowsrc))

  # Specifies a Set of 'bad' tags that the #sanitize helper will remove completely, as opposed
  # to just escaping harmless tags like <font>
  @bad_tags = Set.new(%w(script))

  # Specifies the default Set of tags that the #sanitize helper will allow unscathed.
  @allowed_tags = Set.new(%w(strong em b i p code pre tt samp kbd var sub
sup dfn cite big small address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dl dt dd abbr
acronym a img blockquote del ins))

  # Specifies the default Set of html attributes that the #sanitize helper will leave
  # in the allowed tag.
  @allowed_attributes = Set.new(%w(href src width height alt cite datetime title class name xml:lang abbr))

  # Specifies the default Set of acceptable css properties that #sanitize and #sanitize_css will accept.
  @allowed_protocols = Set.new(%w(ed2k ftp http https irc mailto news gopher nntp telnet webcal xmpp callto
feed svn urn aim rsync tag ssh sftp rtsp afs))

  # Specifies the default Set of acceptable css keywords that #sanitize and #sanitize_css will accept.
  @allowed_css_properties = Set.new(%w(azimuth background-color border-bottom-color border-collapse
border-color border-left-color border-right-color border-top-color clear color cursor direction display
elevation float font font-family font-size font-style font-variant font-weight height letter-spacing line-height
overflow pause pause-after pause-before pitch pitch-range richness speak speak-header speak-numeral speak-punctuation
speech-rate stress text-align text-decoration text-indent unicode-bidi vertical-align voice-family volume white-space
width))

  # Specifies the default Set of acceptable css keywords that #sanitize and #sanitize_css will accept.
  @allowed_css_keywords = Set.new(%w(auto aqua black block blue bold both bottom brown center
collapse dashed dotted fuchsia gray green !important italic left lime maroon medium none navy normal
nowrap olive pointer purple red right solid silver teal top transparent underline white yellow))

  # Specifies the default Set of allowed shorthand css properties for the #sanitize and #sanitize_css helpers.
  @shorthand_css_properties = Set.new(%w(background border margin padding))
end

Public Instance Methods

sanitize(text, options = {}) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 52
def sanitize(text, options = {})
  return text unless sanitizeable?(text)
  tokenize(text, options).join
end
sanitizeable?(text) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 57
def sanitizeable?(text)
  !(text.nil? || text.empty? || !text.index("<"))
end

Protected Instance Methods

contains_bad_protocols?(attr_name, value) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 106
def contains_bad_protocols?(attr_name, value)
  uri_attributes.include?(attr_name) &&
    (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
end
process_attributes_for(node, options) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 93
def process_attributes_for(node, options)
  return unless node.attributes
  node.attributes.keys.each do |attr_name|
    value = node.attributes[attr_name].to_s

    if !options[:attributes].include?(attr_name) || contains_bad_protocols?(attr_name, value)
      node.attributes.delete(attr_name)
    else
      node.attributes[attr_name] = attr_name == 'style' ? sanitize_css(value) : CGI::escapeHTML(CGI::unescapeHTML(value))
    end
  end
end
process_node(node, result, options) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 76
def process_node(node, result, options)
  result << case node
            when HTML::Tag
              if node.closing == :close
                options[:parent].shift
              else
                options[:parent].unshift node.name
              end

              process_attributes_for node, options

              options[:tags].include?(node.name) ? node : nil
            else
              bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;")
            end
end
tokenize(text, options) click to toggle source
# File lib/autolinker/html/sanitizer.rb, line 62
def tokenize(text, options)
  options[:parent] = []
  options[:attributes] ||= allowed_attributes
  options[:tags] ||= allowed_tags

  tokenizer = HTML::Tokenizer.new(text)
  result = []
  while token = tokenizer.next
    node = Node.parse(nil, 0, 0, token, false)
    process_node node, result, options
  end
  result
end