How to sanitize user generated html code in ruby on rails.

Question

I am storing user generated html code in the database, but some of the codes are broken (without end tags), so when this code will mess up the whole render of the page.

How could I prevent this sort of behaviour with ruby on rails.

Thanks

Answer 1

My google-fu reveals surprisingly few hits, but here is the top one :)

Valid Well-formed HTML

Answer 2

Try using the h() escape function in your erb templates to sanitize. That should do the trick

Answer 3

It's not too hard to do this with a proper HTML parser like Nokogiri which can perform clean-up as part of the processing method:

bad_html = '<div><p><strong>bad</p>'

puts Nokogiri.fragment(bad_html).to_s
# <div><p><strong>bad</strong></p></div>

Once parsed properly, you should have fully balanced tags.