Inquisition¶ ↑

Inquisition will sanitize HTML as to help avoid cross site scripting attacks! It keeps your strings heresy-free.

Inquisition offers you three methods on Object:

cleanse_attr *attributes, options
cleanse_attr_reader *attributes, options
cleanse_attr_writer *attributes, options

These methods will wrap your getters and/or setters for an attribute through a HTML5 Sanitizer. This should help to protect against most kinds of cross site scripting attacks.

For example:

cleanse_attr :name, :allow => {:name => /(<strong>)/}

The above example will clean all values written to or read from the name attribute, but will not remove strong tags.

sudo gem install thumblemonks-inquisition

lib/html5lib_sanitize.rb Copyright © Jacques Distler

Everything else is Copyright © 2009 Alexander Rakoczy. See LICENSE for details.