# \[ANN\] loofah 0.4.7 Released **URL:** \ **Category:** Rails\ **Created:** [March 10, 2010, 4:36am UTC](https://www.ruby-forum.com/t/ann-loofah-0-4-7-released/184891 "2010-03-10T04:36:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\ **Post date:** [March 10, 2010, 4:36am UTC](https://www.ruby-forum.com/t/ann-loofah-0-4-7-released/184891/1 "2010-03-10T04:36:47Z")
loofah version 0.4.7 has been released! - [http://github.com/flavorjones/loofah](http://github.com/flavorjones/loofah) - [http://loofah.rubyforge.org](http://loofah.rubyforge.org) - [http://rubyforge.org/projects/loofah](http://rubyforge.org/projects/loofah) Loofah is a general library for manipulating and transforming HTML/XML documents and fragments. It’s built on top of Nokogiri and libxml2, so it’s fast and has a nice API. Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib’s whitelist, so it most likely won’t make your codes less secure. (These statements have not been evaluated by Netexperts.) == Changes 0.4.7 (2010-03-09) Enhancements: - New methods Loofah::HTML::Document#to\_text and Loofah::HTML::DocumentFragment#to\_text do the right thing with whitespace. Note that these methods are significantly slower than #text. GH #12 - Loofah::Elements::BLOCK\_LEVEL contains a canonical list of HTML4 block-level4 elements. - Loofah::HTML::Document#text and Loofah::HTML::DocumentFragment#text will return unescaped HTML entities by passing :encode\_special\_chars =\> false. == Features - Easily write custom scrubbers for HTML/XML leveraging the sweetness of Nokogiri (and HTML5lib’s whitelists). - Common HTML sanitizing tasks are built-in: - _Strip_ unsafe tags, leaving behind only the inner text. - _Prune_ unsafe tags and their subtrees, removing all traces that they ever existed. - _Escape_ unsafe tags and their subtrees, leaving behind lots of \< and \> entities. - _Whitewash_ the markup, removing all attributes and namespaced nodes. - Common HTML transformation tasks are built-in: - Add the _nofollow_ attribute to all hyperlinks. - Format markup as plain text, with or without sensible whitespace handling around block elements. - Replace Rails’s +strip\_tags+ and +sanitize+ helper methods. - Two ActiveRecord extensions: - Loofah::XssFoliate, an XssTerminate[ [GitHub - look/xss\_terminate: xss\_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore.](http://github.com/look/xss_terminate/tree/master)] drop-in replacement, is an _opt-out_ sanitizer. By default all models and attributes are sanitized. - Loofah::ActiveRecordExtension is an _opt-in_ sanitizer. You must explicitly declare attributes to be sanitized. == Compare and Contrast Loofah is one of two known Ruby XSS/sanitization solutions that guarantees well-formed and valid markup (the other is Sanitize, which also uses Nokogiri). Loofah works fine on XML, XHTML and HTML documents. Also, it’s pretty fast. Here is a benchmark comparing Loofah to other commonly-used libraries (ActionView, Sanitize, HTML5lib and HTMLfilter): - [Comparison of Loofah against other Ruby HTML sanitization libraries · GitHub](http://gist.github.com/170193) Lastly, Loofah is extensible. It’s super-easy to write your own custom scrubbers for whatever document manipulation you need. You don’t like the built-in scrubbers? Build your own, like a boss. ---
**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\ **Post date:** [October 26, 2010, 8:50am UTC](https://www.ruby-forum.com/t/ann-loofah-0-4-7-released/184891/2 "2010-10-26T08:50:31Z")
Mike D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Loofah excels at HTML sanitization (XSS prevention). It includes some > nice HTML sanitizers, which are based on HTML5lib’s whitelist, so it > most likely won’t make your codes less secure. (These statements have > not been evaluated by Netexperts.) because i’m using daily nokogiri i wanted to test loofah with a small script (coming from [http://loofah.rubyforge.org/loofah/](http://loofah.rubyforge.org/loofah/)) : #! /opt/local/bin/ruby1.9 # encoding: utf-8 require ‘rubygems’ require ‘nokogiri’ require ‘loofah’ unsafe\_html=“ohai! div is safe ” doc=Loofah.fragment(unsafe\_html).scrub!(:strip) puts doc.to\_s however i got : SyntaxError: /opt/local/lib/ruby1.9/gems/1.9.1/gems/loofah-1.0.0/lib/loofah/html5/scr ub.rb:20: too short escaped multibyte character: /`|[\000-\040\177\s]+|\302[\200-\240]/ method require in untitled document at line 29 method require in untitled document at line 29 method \ in loofah.rb at line 9 method require in untitled document at line 33 method rescue in require in untitled document at line 33 method require in untitled document at line 29 method in loofah\_first\_test.rb at line 22 ruby 1.9.2p0 (2010-08-18 revision 29036) [x86\_64-darwin10] over Mac OS X SL ---
**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\ **Post date:** [March 10, 2010, 4:36am UTC](https://www.ruby-forum.com/t/ann-loofah-0-4-7-released/184891/3 "2010-03-10T04:36:47Z")
loofah version 0.4.7 has been released! - [http://github.com/flavorjones/loofah](http://github.com/flavorjones/loofah) - [http://loofah.rubyforge.org](http://loofah.rubyforge.org) - [http://rubyforge.org/projects/loofah](http://rubyforge.org/projects/loofah) Loofah is a general library for manipulating and transforming HTML/XML documents and fragments. It’s built on top of Nokogiri and libxml2, so it’s fast and has a nice API. Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib’s whitelist, so it most likely won’t make your codes less secure. (These statements have not been evaluated by Netexperts.) == Changes 0.4.7 (2010-03-09) Enhancements: - New methods Loofah::HTML::Document#to\_text and Loofah::HTML::DocumentFragment#to\_text do the right thing with whitespace. Note that these methods are significantly slower than #text. GH #12 - Loofah::Elements::BLOCK\_LEVEL contains a canonical list of HTML4 block-level4 elements. - Loofah::HTML::Document#text and Loofah::HTML::DocumentFragment#text will return unescaped HTML entities by passing :encode\_special\_chars =\> false. == Features - Easily write custom scrubbers for HTML/XML leveraging the sweetness of Nokogiri (and HTML5lib’s whitelists). - Common HTML sanitizing tasks are built-in: - _Strip_ unsafe tags, leaving behind only the inner text. - _Prune_ unsafe tags and their subtrees, removing all traces that they ever existed. - _Escape_ unsafe tags and their subtrees, leaving behind lots of \< and \> entities. - _Whitewash_ the markup, removing all attributes and namespaced nodes. - Common HTML transformation tasks are built-in: - Add the _nofollow_ attribute to all hyperlinks. - Format markup as plain text, with or without sensible whitespace handling around block elements. - Replace Rails’s +strip\_tags+ and +sanitize+ helper methods. - Two ActiveRecord extensions: - Loofah::XssFoliate, an XssTerminate[ [GitHub - look/xss\_terminate: xss\_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore.](http://github.com/look/xss_terminate/tree/master)] drop-in replacement, is an _opt-out_ sanitizer. By default all models and attributes are sanitized. - Loofah::ActiveRecordExtension is an _opt-in_ sanitizer. You must explicitly declare attributes to be sanitized. == Compare and Contrast Loofah is one of two known Ruby XSS/sanitization solutions that guarantees well-formed and valid markup (the other is Sanitize, which also uses Nokogiri). Loofah works fine on XML, XHTML and HTML documents. Also, it’s pretty fast. Here is a benchmark comparing Loofah to other commonly-used libraries (ActionView, Sanitize, HTML5lib and HTMLfilter): - [Comparison of Loofah against other Ruby HTML sanitization libraries · GitHub](http://gist.github.com/170193) Lastly, Loofah is extensible. It’s super-easy to write your own custom scrubbers for whatever document manipulation you need. You don’t like the built-in scrubbers? Build your own, like a boss.