RoR SanitizeHelper Allow script tag content

Question

I have constructed a whitelist of all the tags I want to allow when sanitizing a document which includes script tags and used ActionView::Helpers::SanitizeHelper to help with the sanitizing. My problem is that the script tag is allowed to display in the HTML source but the contents of the script are removed.

I can display without the sanitizing for this specific section of my application but would prefer to keep everything consistent.

This is my line code for that sanitizing section

#{sanitize @page.body, tags: t("sanitize.whitelist").split(/\s/), attributes: %w(id class style alt src href target)}

Any help would be appreciated before I just have to resolve to removing sanitizing on this section.

Answer 1

I usually do something like this in config/application.rb

config.action_view.sanitized_allowed_tags = 'a', 'br'

And then if you need to allow a separate set of tags for different purposes:

config.action_view.sanitized_allowed_other_tags = ['a', 'br', 'script']

Then you can do:

#{sanitize @page.body, tags: Rails.configuration.sanitized_allowed_other_tags, attributes: %w(id class style alt src href target)}

It may not be the best solution, but at least it allows you to only have to change the allowed tags in one place.