white_list_sanitizer is deprecated

[jacobat]

Steps to reproduce

Call simple_format in a view.

Expected behavior

No deprecation warnings are raised.

Actual behavior

DEPRECATION WARNING: warning: white_list_sanitizer isdeprecated, please use safe_list_sanitizer instead.

System configuration

Rails version:

6.0.0RC2

Ruby version:

2.6.3

[kaspth]

Can you try with 6-0-stable? Should be fixed there.

[andrewkress]

fixed with this commit

[kaspth]

Yeah, that's the one! I've backported it to 5-2-stable as well: 2cd4bce

[Mange]

Will the 5.2 backport be released soon? We'd like to have deprecations :raise again. 🙂

[jrochkind]

For anyone wondering what's going on, rails_html_sanitizer deprecated white_list_sanitizer in it's release 1.1.0 released August 5th. CHANGELOG

It appears to be a simple name change to safe_list_sanitizer, no functionality change. rails/rails-html-sanitizer#87

So if you upgrade the rails-html-sanitizer version in your Gemfile.lock, you'll start getting this deprecation warning. This can happen even if you have not upgraded Rails. Running bundle update might cause your rails-html-sanitizer to update to 1.1.0, or running bundle update some_gem if rails-html-sanitizer is a dependency (direct or transitive) of some_gem.

When the deprecated method name is being called by Rails itself (as it is by simple_format), the only way to avoid the deprecation is to:

a) Update to a new version of Rails (which do not yet exist at present) that does not call the deprecated method name (not sure if a 5.2 release will be made that does so. Older versions probably not? Might require a 6.0 upgrade)

b) Don't use rails_html_sanitizer 1.1.0 or above. You might add to your Gemfile gem "rails-html-sanitizer", "< 1.1.0". Problem here is you won't get any future bugfixes or security patches. (rails-html-sanitizer 1.1.0 itself seems to have no changes of significance -- other than this one -- from 1.0.4).

c) Wrap all calls to simple_format in ActiveSupport::Deprecation.silence do .. end. (haven't tested but should work).

[kaspth]

Hey! Sorry about all the fuss here. I screwed up the 1.1.0 release. Rails 5.2 was never meant to trigger deprecation warnings.

I've just released rails-html-sanitizer 1.2.0 that removes the deprecation warnings for Rails 5.2 (Rails 6 apps will just require >= 1.2.0 and use the new API directly).

If there's more issues, please open a new issue so it won't end up lost in here for others. If someone wants to confirm that it works for them, feel free to comment directly here. Thanks everyone and sorry for all the confusion ❤️

[Mange]

I can confirm that the new version worked! Thank you! ❤️

Full fix:

bundle update rails-html-sanitizer