scinote-web/app/helpers/input_sanitize_helper.rb

37 lines
1.2 KiB
Ruby
Raw Normal View History

require 'sanitize'
2017-01-03 05:27:12 +08:00
module InputSanitizeHelper
# Rails default ActionController::Base.helpers.sanitize method call
# the ActiveRecord connecton method on the caller object which in
# our cases throws an error when called from not ActiveRecord objects
2017-05-10 21:33:33 +08:00
# such as SamplesDatatables
def sanitize_input(html, tags = [], attributes = [])
Sanitize.fragment(
html,
2017-05-10 21:33:33 +08:00
elements: Constants::WHITELISTED_TAGS + tags,
attributes: { all: Constants::WHITELISTED_ATTRIBUTES + attributes },
css: Constants::WHITELISTED_CSS_ATTRIBUTES
).html_safe
2017-01-03 05:27:12 +08:00
end
def escape_input(text)
ERB::Util.html_escape(text)
end
def custom_auto_link(text, options = {})
2017-05-09 17:25:00 +08:00
simple_f = options.fetch(:simple_format) { true }
team = options.fetch(:team) { nil }
wrapper_tag = options.fetch(:wrapper_tag) { {} }
tags = options.fetch(:tags) { [] }
format_opt = wrapper_tag.merge(sanitize: false)
2017-05-09 17:25:00 +08:00
text = sanitize_input(text, tags)
text = simple_format(sanitize_input(text), {}, format_opt) if simple_f
auto_link(
smart_annotation_parser(text, team),
link: :urls,
sanitize: false,
html: { target: '_blank' }
).html_safe
end
2017-01-03 05:27:12 +08:00
end