From 1e64885d30668165c63cccc4e371d1fc2755324a Mon Sep 17 00:00:00 2001 From: Paul Mesnilgrente Date: Tue, 9 Feb 2021 18:03:27 +0100 Subject: [PATCH] Add a note for whitelisted tags by default in the TargetScrubber (#110) * add a note for whitelisted tags by default in the TargetScrubber * reword the whitelisted to permitted Co-authored-by: Kasper Timm Hansen * added the permitted tag list to the README Co-authored-by: Kasper Timm Hansen --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b3e9fb0..7b160b5 100644 --- a/README.md +++ b/README.md @@ -81,8 +81,10 @@ html_fragment.to_s # => "" #### `Rails::Html::TargetScrubber` Where `PermitScrubber` picks out tags and attributes to permit in sanitization, -`Rails::Html::TargetScrubber` targets them for removal. +`Rails::Html::TargetScrubber` targets them for removal. See https://github.com/flavorjones/loofah/blob/main/lib/loofah/html5/safelist.rb for the tag list. +**Note:** by default, it will scrub anything that is not part of the permitted tags from +loofah `HTML5::Scrub.allowed_element?`. ```ruby scrubber = Rails::Html::TargetScrubber.new