Strip html from string Ruby on Rails

Question

I'm working with Ruby on Rails, Is there a way to strip html from a string using sanitize or equal method and keep only text inside value attribute on input tag?

Jon · Accepted Answer · 2012-10-17 17:28:15Z

214

If we want to use this in model

ActionView::Base.full_sanitizer.sanitize(html_string)

which is the code in "strip_tags" method

answered Oct 17, 2012 at 17:28

Jon

2,8233 gold badges20 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Nik Haldimann Over a year ago

This works but referring to ActionView from the mdoel is awkward. More cleanly you can require 'html/sanitizer' and instantiate your own sanitizer with HTML::FullSanitizer.new.

Linh Dam Over a year ago

@nhaldimann, require 'html/sanitizer' raises error so I have to use: Rails::Html::FullSanitizer.new (edgeapi.rubyonrails.org/classes/HTML/…)

dostu Over a year ago

I'm using Rails::Html::FullSanitizer.new.sanitize(string) with Rails 7

Michael Kohl · Accepted Answer · 2011-09-14 09:49:36Z

152

There's a strip_tags method in ActionView::Helpers::SanitizeHelper:

http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags

Edit: for getting the text inside the value attribute, you could use something like Nokogiri with an Xpath expression to get that out of the string.

answered Sep 14, 2011 at 9:49

Michael Kohl

66.9k14 gold badges144 silver badges161 bronze badges

Comments

Satishakumar Awati · Accepted Answer · 2019-05-06 11:03:07Z

39

ActionView::Base.full_sanitizer.sanitize(html_string)

White list of tags and attributes can be specified as bellow

ActionView::Base.full_sanitizer.sanitize(html_string, :tags => %w(img br p), :attributes => %w(src style))

Above statement allows tags img, br and p and attributes src and style.

edited May 6, 2019 at 11:03

answered Jul 2, 2015 at 9:07

Satishakumar Awati

3,8101 gold badge33 silver badges56 bronze badges

Comments

Abram · Accepted Answer · 2018-08-02 14:51:11Z

38

Yes, call this: sanitize(html_string, tags:[])

edited Aug 2, 2018 at 14:51

Abram

42.5k28 gold badges139 silver badges187 bronze badges

answered Mar 15, 2013 at 14:40

bcackerman

1,5642 gold badges22 silver badges37 bronze badges

1 Comment

taylorthurlow Over a year ago

Working well in 2024 and Rails 7, no extra requires/includes required here. The tags: [] argument is important, this is what excludes all HTML tags. Otherwise you'll actually get raw HTML and that will render in-page.

taiar · Accepted Answer · 2019-01-28 17:15:50Z

10

I've used the Loofah library, as it is suitable for both HTML and XML (both documents and string fragments). It is the engine behind the html sanitizer gem. I'm simply pasting the code example to show how simple it is to use.

Loofah Gem

unsafe_html = "ohai! <div>div is safe</div> <script>but script is not</script>"

doc = Loofah.fragment(unsafe_html).scrub!(:strip)
doc.to_s    # => "ohai! <div>div is safe</div> "
doc.text    # => "ohai! div is safe "

edited Jan 28, 2019 at 17:15

taiar

5626 silver badges22 bronze badges

answered Oct 2, 2017 at 7:15

Krishna Vedula

1,8031 gold badge29 silver badges32 bronze badges

Comments

s1mpl3 · Accepted Answer · 2022-09-10 20:35:14Z

3

If you want to remove all html tags you can use

   htm.gsub(/<[^>]*>/,'')

answered Sep 10, 2022 at 20:35

s1mpl3

1,4741 gold badge10 silver badges14 bronze badges

Comments

josetapadas · Accepted Answer · 2015-09-08 19:14:16Z

2

How about this?

white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
WHITELIST = ['p','b','h1','h2','h3','h4','h5','h6','li','ul','ol','small','i','u']


[Your, Models, Here].each do |klass| 
  klass.all.each do |ob| 
    klass.attribute_names.each do |attrs|
      if ob.send(attrs).is_a? String
        ob.send("#{attrs}=", white_list_sanitizer.sanitize(ob.send(attrs), tags: WHITELIST, attributes: %w(id style)).gsub(/<p>\s*<\/p>\r\n/im, ''))
        ob.save
      end
    end
  end
end

answered Sep 8, 2015 at 19:14

josetapadas

2,6573 gold badges22 silver badges20 bronze badges

1 Comment

Fredrik Over a year ago

There is also Rails::Html::FullSanitizer.new if you don't want to specify a whitelist.

Sergio Belevskij · Accepted Answer · 2021-04-08 18:30:46Z

0

This is working for me in rails 6.1.3:

.errors-description
  = sanitize(message, tags: %w[div span strong], attributes: %w[class])

answered Apr 8, 2021 at 18:30

Sergio Belevskij

3,0472 gold badges28 silver badges31 bronze badges

Comments

Joshua Pinter · Accepted Answer · 2023-03-02 19:53:02Z

0

If your HTML is coming from ActionText, you can do .to_plain_text:

@my_string = <p>My HTML String</p>
@my_string.to_plain_text
=> My HTML String

https://www.rubydoc.info/github/rails/rails/ActionText%2FContent:to_plain_text

edited Mar 2, 2023 at 19:53

Joshua Pinter

47.9k23 gold badges261 silver badges258 bronze badges

answered Dec 4, 2022 at 13:58

epicrato

8,5986 gold badges49 silver badges50 bronze badges

2 Comments

Joshua Pinter Over a year ago

What is this? .to_plain_text isn't a thing in the core.

epicrato Over a year ago

@JoshuaPinter You are correct. Just updated my answer. Thanks!

Collectives™ on Stack Overflow

Strip html from string Ruby on Rails

9 Answers 9

3 Comments

Comments

Comments

1 Comment

Comments

Comments

1 Comment

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

9 Answers 9

3 Comments

Comments

Comments

1 Comment

Comments

Comments

1 Comment

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related