# Loofah 0.2.0 Released

**URL:** <https://www.ruby-forum.com/t/loofah-0-2-0-released/173547>\
**Category:** Ruby\
**Created:** [August 11, 2009, 8:46am UTC](https://www.ruby-forum.com/t/loofah-0-2-0-released/173547 "2009-08-11T08:46:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\
**Post date:** [August 11, 2009, 8:46am UTC](https://www.ruby-forum.com/t/loofah-0-2-0-released/173547/1 "2009-08-11T08:46:48Z")

</div>

loofah version 0.2.0 has been released!

- [http://loofah.rubyforge.org/](http://loofah.rubyforge.org/)
- [http://rubyforge.org/projects/loofah](http://rubyforge.org/projects/loofah)
- [http://github.com/flavorjones/loofah](http://github.com/flavorjones/loofah)

Loofah is an HTML sanitizer. It will _always_ fix broken markup, but  
can also sanitize unsafe tags in a few different ways, and transform  
the markup for storage or display.

It’s built on top of Nokogiri and libxml2, so it’s fast. And it uses  
html5lib’s whitelist, so it most likely won’t make your codes less  
secure.

(These statements have not been evaluated by Internet Experts.)

This library was formerly known as Dryopteris.

## FEATURES

- Strip unsafe tags, leaving behind only the inner text.
- Prune unsafe tags and their subtrees, removing all traces that they  
ever  
existed.
- Escape unsafe tags and their subtrees, leaving behind lots of \< and  
\> entities.
- Whitewash the markup, removing all attributes and namespaced nodes.
- Format the markup as plain text.
- ActiveRecord extension.
- 99 44/100 % Tenderlove-free!

## SYNOPSIS

For a full explanation, see the documentation for Loofah.

require ‘loofah’

unsafe\_html = “ohai!

a div is safe
 ”

Loofah.scrub\_fragment(unsafe\_html, :prune).to\_s # =\> "ohai!

div  
is  
safe
 "

OR

doc = Loofah.fragment(unsafe\_html) # returns a Nokogiri document …  
doc.scrub!(:prune) # … with one extra method  
doc.to\_s # =\> "ohai!

div is safe
  
"  
doc.text # =\> "ohai! div is safe "

### ACTIVERECORD EXTENSION

# config/environment.rb

require ‘loofah/active\_record’

# db/schema.rb

create\_table “posts” do |t|  
t.string “title”  
t.string “body”  
end

# app/model/post.rb

class Post \< ActiveRecord::Base  
html\_fragment :body, :scrub =\> :prune # scrubs ‘body’ in a  
before\_save  
end

## REQUIREMENTS

- ruby 1.8 or 1.9
- Nokogiri \>= 1.3.3

## INSTALLATION

Unsurprisingly:

- gem install loofah

Changes:

## 0.2.0

- Swank new API.
- ActiveRecord extension.
- Uses Nokogiri’s Document and DocumentFragment for parsing.
- Updated html5lib codes and tests to revision 1384:b9d3153d7be7.
- Deprecated the Dryopteris sanitization methods. Will be removed in  
0.3.0.
- Documentation! Hey!