Skip to content

LIBTD-1420: Add loofah sanitizer when displaying work description

Janice J Kim requested to merge LIBTD-1420 into dev

You should be able to enter in descriptions for COMPEL works that contain questionable HTML tags. Upon displaying in the show pages, however, the helper function for displaying html_safe content has been modified to use the Loofah HTML sanitizer to whitewash known "unknown/unsafe/namespaced tags and their children and strips all node attributes" (according to https://github.com/flavorjones/loofah).

For example, the following:

<em>HI!</em> <script>...</script> <ul><li>hi</li></ul>

will be whitewashed of the questionable <script> tags.

NOTE: I've chosen the strictest setting -- :whitewash. This will take out the href in tags. We can also try :prune if you want it less strict, but I thought to err on the side of caution.

Or, maybe we can make this configurable, if someone thinks it's necessary.

Merge request reports