Your friends at Viget present Extend, a Code & Technology Blog

HTML Sanitization In Rails That Actually Works

Assuming you don’t want to simply escape everything, sanitizing user input is one of the relative weak points of the Rails framework. On SpeakerRate, where users can use Markdown to format comments and descriptions, we’ve run up against some of the limitations of Rails’ built-in sanitization features, so we decided to dig in and fix it ourselves.

In creating our own sanitizer, our goals were threefold: we want to let a subset of HTML in. As the Markdown documentation clearly states, “for any markup that is not covered by Markdown’s syntax, you simply use HTML itself.” In keeping with the Markdown philosophy, we can’t simply strip all HTML from incoming comments, so the included HTML::WhiteListSanitizer is the obvious starting point.

Additionally, we want to escape, rather than remove, non-approved tags, since some commenters want to discuss the merits of, say, <h2 class="h2">. Contrary to its documentation, WhiteListSanitizer simply removes all non-whitelisted tags. Someone opened a ticket about this issue in August of 2008 with an included patch, but the ticket was marked as resolved without ever applying it. Probably for the best, as the patch introduces a new bug.

Finally, we want to escape unclosed tags even if they belong to the whitelist. An unclosed <strong> tag can wreak havoc on the rest of a page, not to mention what a <div> can do. Self-closing tags are okay.

With these requirements in mind, we subclassed HTML::WhiteListSanitizer and fixed it up. Introducing, then:

Jason Statham

HTML::StathamSanitizer. User-generated markup, you’re on notice: this sanitizer will take its shirt off and use it to kick your ass. At this point, I’ve written more about the code than code itself, so without further ado:

module HTML
  class StathamSanitizer < WhiteListSanitizer


    def tokenize(text, options) do |token|
        if token.is_a?(HTML::Tag) && options[:parent].include?(
          token.to_s.gsub(/</, "&lt;")

    def process_node(node, result, options)
      result << case node
        when HTML::Tag
          if node.closing == :close && options[:parent].first ==
          elsif node.closing != :self

          process_attributes_for node, options

          if options[:tags].include?(
            bad_tags.include?( ? nil : node.to_s.gsub(/</, "&lt;")
          bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;")

As always, download and fork at the ’hub.

Get More From Viget

Subscribe to get our monthly newsletter and occasional special announcements.