rgrove/sanitize
Sanitize
Sanitize is a Ruby library designed to clean untrusted HTML and CSS input by enforcing strict security policies. It functions as a web input validator and security filtering tool, processing HTML fragments or full documents to remove unauthorized elements, attributes, and dangerous code patterns that could lead to cross-site scripting or injection attacks.
The library distinguishes itself through a tree-based traversal mechanism that evaluates document structures against customizable allowlists. Beyond standard filtering, it provides granular control over content by allowing developers to inject custom logic for node transformation and URL validation. This enables the application of tailored security policies that can accommodate specific formatting requirements while maintaining a secure output.
The project covers a comprehensive range of sanitization capabilities, including the recursive parsing of style declarations to prevent CSS injection and the reconstruction of sanitized content through document fragment serialization. Developers can configure parsing behavior and define custom rules to balance security needs with the desired level of markup support.
Features
- HTML Sanitization - Prevents cross-site scripting attacks by stripping malicious elements and attributes from user-provided HTML content before rendering.
- HTML Allowlists - Enforces security by explicitly permitting only known safe HTML elements and attributes while discarding all other unrecognized input.
- CSS Injection Preventers - Cleans style attributes and stylesheets to ensure that embedded CSS properties do not contain dangerous or unauthorized code.
- HTML Element Transformers - Applies specialized logic to inspect or modify specific HTML elements during the sanitization process for complex content requirements.
- Sanitization Callbacks - Provides hooks for developers to inject custom logic to modify or inspect specific nodes during the sanitization traversal.
- HTML Fragment Serializers - Reconstructs sanitized content by converting the modified tree structure back into a clean string format for safe output.
- HTML Node Transformers - Executes custom logic on specific HTML nodes during sanitization to perform complex filtering or modifications beyond standard allowlist checks.
- Embedded URL Validators - Checks and filters URLs found within HTML attributes or CSS imports to ensure they point to trusted and safe locations.
- DOM Tree Traversers - Processes HTML by walking a hierarchical document object model to evaluate each element against a defined security policy.
- CSS Sanitizers - Parses and cleans CSS properties and at-rules within style attributes or stylesheets to prevent malicious injection attacks.
- Customizable Sanitization Rules - Allows developers to create tailored security policies by merging or overriding default allowlists to permit specific elements and attributes.
- Document Security Sanitizers - Processes complete HTML documents including doctype definitions to ensure the entire structure adheres to established security policies.
- HTML Input Validators - Processes untrusted HTML fragments and full documents to ensure they conform to safe, predefined structural standards.
- HTML Security Policy Enforcers - Enforces standard sets of HTML and CSS restrictions ranging from minimal text-only output to permissive formatting and media support.
- Resource URL Validations - Enforces security policies on embedded resource URLs within HTML and CSS to prevent unauthorized external loading or malicious injection.
- Web Content Security Filters - Enforces security policies on web content by stripping unauthorized elements, attributes, and dangerous CSS properties.
- CSS Style Parsers - Deconstructs style declarations into individual properties and rules to validate them against strict safety constraints before reassembly.
