I’ve written a ROR helper (which ended up being relatively similar to this one) based on the “Easy HTML Whitelists” recipe in the Pragmatic Programmers Rails Recipes book.

The big problem with that recipe is that it allows any attributes on whitelisted tags. Not good. I could throw in nasty background images or cookie-stealing onclick/onmouseover events. XSS == teh badness.

Originally, I just stripped all the attributes, but in this post RoR Newbie asks “how can I allow SOME attributes?”

Thus was this helper born. It allows you to define “tag profiles” of allowed tags and attributes, and gives you the ability to allow different levels of sanitizing for different purposes/users. See the Rdoc for a fuller explanation.

Lemme know what you think. Dan at NOSPAMEendpoint dot com

HTMLFilterHelper

Rdoc:

http://www.kookdujour.com/doc/

The helper:

http://www.kookdujour.com/html_filter_helper.rb.txt

Try it out:

http://www.kookdujour.com/filter_test