# Loofah 0.4.2 Released

**URL:** <https://www.ruby-forum.com/t/loofah-0-4-2-released/182177>\
**Category:** Ruby\
**Created:** [January 24, 2010, 5:06am UTC](https://www.ruby-forum.com/t/loofah-0-4-2-released/182177 "2010-01-24T05:06:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\
**Post date:** [January 24, 2010, 5:06am UTC](https://www.ruby-forum.com/t/loofah-0-4-2-released/182177/1 "2010-01-24T05:06:27Z")

</div>

loofah version 0.4.2 has been released!

- [http://loofah.rubyforge.org](http://loofah.rubyforge.org)
- [http://rubyforge.org/projects/loofah](http://rubyforge.org/projects/loofah)
- [http://github.com/flavorjones/loofah](http://github.com/flavorjones/loofah)

Loofah is a general library for manipulating HTML/XML documents and  
fragments. It’s built on top of Nokogiri and libxml2, so it’s fast and  
has a nice API.

Loofah excels at HTML sanitization (XSS prevention). It includes some  
nice HTML sanitizers, which are based on HTML5lib’s whitelist, so it  
most likely won’t make your codes less secure. (These statements have  
not been evaluated by Netexperts.)

## Changes

# 0.4.2 (2010-01-22)

Enhancements:

- Implemented Node#scrub! for scrubbing subtrees.
- Implemented NodeSet#scrub! for scrubbing a set of subtrees.
- Document.text now only serializes contents (ignores )
- , and added to the HTML5lib whitelist.

Bug fixes:

- Supporting Rails apps that aren’t loading ActiveRecord. GH #10

Miscellaneous:

- Mailing list is now removed\_email\_address@domain.invalid / [http://librelist.com](http://librelist.com)
- IRC channel is now #loofah on freenode.

# Features

- Easily write custom scrubbers for HTML/XML leveraging the sweetness  
of Nokogiri (and HTML5lib’s whitelists).

- Common HTML sanitizing tasks are built-in:

- Common HTML transformation tasks are built-in:

- Format markup as plain text.

- Replace Rails’s +strip\_tags+ and +sanitize+ helper methods.

- Two ActiveRecord extensions:

# Compare and Contrast

Loofah is one of two known Ruby XSS/sanitization solutions that  
guarantees well-formed and valid markup (the other is Sanitize, which  
also uses Nokogiri).

Loofah works fine on XML, XHTML and HTML documents.

Also, it’s pretty fast. Here is a benchmark comparing Loofah to other  
commonly-used libraries (ActionView, Sanitize, HTML5lib and HTMLfilter):

- [Comparison of Loofah against other Ruby HTML sanitization libraries · GitHub](http://gist.github.com/170193)

Lastly, Loofah is extensible. It’s super-easy to write your own custom  
scrubbers for whatever document manipulation you need. You don’t like  
the built-in scrubbers? Build your own, like a boss.