Rails - Escaping HTML using the h() AND excluding specific tags

Question

I was wondering, and was as of yet, unable to find any answers online, how to accomplish the following.

Let's say I have a string that contains the following:

my_string = "Hello, I am a string." (in the preview window I see that this is actually formatting in BOLD and ITALIC instead of showing the "strong" and "i" tags)

Now, I would like to make this secure, using the html_escape() (or h()) method/function. So I'd like to prevent users from inserting any javascript and/or stylesheets, however, I do still want to have the word "Hello" shown in bold, and the word "string" shown in italic.

As far as I can see, the h() method does not take any additional arguments, other than the piece of text itself.

Is there a way to escape only certain html tags, instead of all? Like either White or Black listing tags?

Example of what this might look like, of what I'm trying to say would be:

h(my_string, :except => [:strong, :i]) # => so basically, escape everything, but leave "strong" and "i" tags alone, do not escape these.

Is there any method or way I could accomplish this?

Thanks in advance!

Answer 1

Excluding specific tags is actually pretty hard problem. Especially the script tag can be inserted in very many different ways - detecting them all is very tricky.

If at all possible, don't implement this yourself.

Answer 2

Use the white list plugin or a modified version of it . It's superp! You can have a look Sanitize as well(Seems better, never tried it though).