如何清除Rails中的ruby中的“内联JavaScript”？

Question

I am specifically developing an app in ruby on rails and i find that the ruby gem "sanitize" is very useful for cleaning the input by user but it does not remove inline javascript which makes it rather useless

I have gone through these but that does not sanitize inline javascript

Is there any better to do this(any gems or so)?

Answer 1

Well you can set a whitelist for sanitize to only allow specific tags and attributes, so i guess you already got what you are looking for:

Sanitize.clean(html, :elements => ['a', 'span'],
    :attributes => {'a' => ['href', 'title'], 'span' => ['class']},
    :protocols => {'a' => {'href' => ['http', 'https', 'mailto']}})

Snipped from http://wonko.com/post/sanitize