# Loofah 0.3.0 Released

**URL:** <https://www.ruby-forum.com/t/loofah-0-3-0-released/176859>\
**Category:** Ruby\
**Created:** [October 7, 2009, 6:11am UTC](https://www.ruby-forum.com/t/loofah-0-3-0-released/176859 "2009-10-07T06:11:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\
**Post date:** [October 7, 2009, 6:11am UTC](https://www.ruby-forum.com/t/loofah-0-3-0-released/176859/1 "2009-10-07T06:11:38Z")

</div>

loofah version 0.3.0 has been released!

- [http://loofah.rubyforge.org](http://loofah.rubyforge.org)
- [http://rubyforge.org/projects/loofah](http://rubyforge.org/projects/loofah)
- [http://github.com/flavorjones/loofah](http://github.com/flavorjones/loofah)

Loofah is an HTML sanitizer. It will always fix broken markup, but  
can also sanitize unsafe tags in a few different ways, and transform  
the markup for storage or display.

It’s built on top of Nokogiri and libxml2, so it’s fast. And it uses  
html5lib’s whitelist, so it most likely won’t make your codes less  
secure. \*

- These statements have not been evaluated by Netexperts.

Changes:

## 0.3.0 (2009-10-06)

Enhancements:

- New ActiveRecord extension `xss_foliate`, a drop-in replacement for  
xss\_terminate.
- Replacement methods for ActionView’s helper methods `sanitize()` and  
`strip_tags()`.
- Official support (and test coverage) for Rails versions 2.3, 2.2, 2.1,  
2.0  
and 1.2.

Deprecations:

- The methods strip\_tags, whitewash, whitewash\_document, sanitize, and  
sanitize\_document have been deprecated. See DEPRECATED.rdoc for  
details on the equivalent calls with the post-0.2 API.

== FEATURES

- _Strip_ unsafe tags, leaving behind only the inner text.
- _Prune_ unsafe tags and their subtrees, removing all traces that they  
ever  
existed.
- _Escape_ unsafe tags and their subtrees, leaving behind lots of \<  
and  
\> entities.
- _Whitewash_ the markup, removing all attributes and namespaced nodes.
- Format the markup as plain text.
- Two ActiveRecord extensions:
  - An _opt-out_ sanitizer that sanitizes all models and attributes by  
default  
(it’s also an XssTerminate drop-in replacement).
  - An _opt-in_ sanitizer which sanitized the attributes you  
explicitly declare to be sanitized.

- 99 44/100 % pure
- Performance compares favorably with similar libraries:  
[Comparison of Loofah against other Ruby HTML sanitization libraries · GitHub](http://gist.github.com/170193)