merging with master

Leandro Santos
2 parents 8307cfb7 27f11bf7
Showing 16 changed files with 151 additions and 127 deletions Show diff stats
.travis.yml
app/controllers/my_profile/tasks_controller.rb
app/helpers/comment_helper.rb
app/helpers/sanitize_helper.rb
app/models/article.rb
app/models/link_list_block.rb
app/models/scrap.rb
app/models/task.rb
app/models/textile_article.rb
app/views/tasks/index.html.erb
config/application.rb
config/initializers/sanitizer.rb
lib/sanitize_params.rb
test/functional/search_controller_test.rb
test/functional/tasks_controller_test.rb
vendor/plugins/xss_terminate/lib/xss_terminate.rb
@@ -5,15 +5,19 @@ notifications:
     template:
       - "%{repository_slug} %{branch} %{commit} %{commit_subject} - %{result} %{build_url}"
-# trusty constainers take more time to start
-#dist: trusty
+# Ensure Container-based environment, as others can have some random failures
+# specially with different Firefox versions and selenium tests.
+# E.g. https://travis-ci.org/noosfero/noosfero/jobs/122918772#L1308
+#
+# Also container-based environments have the fatest boot times and
+# are the only one with cache available for public projects.
+# See https://docs.travis-ci.com/user/ci-environment/#Virtualization-environments
+sudo: false
+cache: bundler
 language: ruby
 rvm:
-  - 2.2
-  # ruby 2.3 works but isn't stable on travis
-
-cache: bundler
+  - 2.3.0
 addons:
   apt:
@@ -18,16 +18,16 @@ class TasksController &lt; MyProfileController
     @task_types = Task.pending_types_for(profile)
     @task_tags = [OpenStruct.new(:name => _('All'), :id => nil) ] + Task.all_tags
-    @tasks = Task.pending_all(profile, @filter_type, @filter_text).order_by('created_at', 'asc')
+    @tasks = Task.pending_all(profile, @filter_type, @filter_text).order_by('created_at', 'asc').paginate(:per_page => Task.per_page, :page => params[:page])
     @tasks = @tasks.where(:responsible_id => @filter_responsible.to_i != -1 ? @filter_responsible : nil) if @filter_responsible.present?
     @tasks = @tasks.tagged_with(@filter_tags, any: true) if @filter_tags.present?
     @tasks = @tasks.paginate(:per_page => Task.per_page, :page => params[:page])
-
     @failed = params ? params[:failed] : {}
     @responsible_candidates = profile.members.by_role(profile.roles.reject {|r| !r.has_permission?('perform_task') && !r.has_permission?('view_tasks')}) if profile.organization?
     @view_only = !current_person.has_permission?(:perform_task, profile)
+
   end
   def processed
@@ -66,7 +66,7 @@ module CommentHelper
   def link_for_edit(comment)
     if comment.can_be_updated_by?(user)
-      {:link => expirable_comment_link(comment, :edit, _('Edit'), url_for(:profile => profile.identifier, :controller => :comment, :action => :edit, :id => comment.id),:class => 'modal')}
+      {:link => expirable_comment_link(comment, :edit, _('Edit'), url_for(:profile => profile.identifier, :controller => :comment, :action => :edit, :id => comment.id), :modal => true)}
     end
   end
@@ -0,0 +1,25 @@
+module SanitizeHelper
+
+  def sanitize_html(text, type= :full_sanitize)
+      sanitizer(type).sanitize(text, scrubber: permit_scrubber)
+  end
+
+  def sanitize_link(text)
+      sanitizer(:white_list).sanitize(text, scrubber:permit_scrubber)
+  end
+
+protected
+
+  def permit_scrubber
+      scrubber = Rails::Html::PermitScrubber.new
+      scrubber.tags = Rails.application.config.action_view.sanitized_allowed_tags
+      scrubber.attributes = Rails.application.config.action_view.sanitized_allowed_attributes
+      scrubber
+  end
+
+  def sanitizer type = :full_sanitize
+    return HTML::WhiteListSanitizer.new if type == :white_list
+    HTML::FullSanitizer.new
+  end
+
+end
 class Article < ActiveRecord::Base
+  include SanitizeHelper
+
   attr_accessible :name, :body, :abstract, :profile, :tag_list, :parent,
                   :allow_members_to_edit, :translation_of_id, :language,
                   :license_id, :parent_id, :display_posts_in_current_language,
@@ -54,6 +56,7 @@ class Article &lt; ActiveRecord::Base
   track_actions :create_article, :after_create, :keep_params => [:name, :url, :lead, :first_image], :if => Proc.new { |a| a.is_trackable? && !a.image? }
   # xss_terminate plugin can't sanitize array fields
+  # sanitize_tag_list is used with SanitizeHelper
   before_save :sanitize_tag_list
   before_create do |article|
@@ -875,11 +878,6 @@ class Article &lt; ActiveRecord::Base
     tag_name.gsub(/[<>]/, '')
   end
-  def sanitize_html(text)
-    sanitizer = HTML::FullSanitizer.new
-    sanitizer.sanitize(text)
-  end
-
   def parent_archived?
      if self.parent_id_changed? && self.parent && self.parent.archived?
        errors.add(:parent_folder, N_('is archived!!'))
 class LinkListBlock < Block
+  include SanitizeHelper
+
   attr_accessible :links
   ICONS = [
@@ -85,9 +87,4 @@ class LinkListBlock &lt; Block
     end
   end
-  def sanitize_link(text)
-    sanitizer = HTML::WhiteListSanitizer.new
-    sanitizer.sanitize(text)
-  end
-
 end
 class Scrap < ActiveRecord::Base
+  include SanitizeHelper
+
   attr_accessible :content, :sender_id, :receiver_id, :scrap_id
   SEARCHABLE_FIELDS = {
@@ -41,8 +43,7 @@ class Scrap &lt; ActiveRecord::Base
   end
   def strip_all_html_tags
-    sanitizer = HTML::WhiteListSanitizer.new
-    self.content = sanitizer.sanitize(self.content, :tags => [])
+    self.content = sanitize_html(self.content)
   end
   def action_tracker_target
@@ -347,6 +347,7 @@ class Task &lt; ActiveRecord::Base
     where [environment_condition, profile_condition].compact.join(' OR ')
   }
+
   def self.pending_types_for(profile)
     Task.to(profile).pending.select('distinct type').map { |t| [t.class.name, t.title] }
   end
 class TextileArticle < TextArticle
+  include SanitizeHelper
   def self.short_description
     _('Text article with Textile markup language')
@@ -31,10 +32,9 @@ class TextileArticle &lt; TextArticle
   protected
   def convert_to_html(textile)
-    @@sanitizer ||= HTML::WhiteListSanitizer.new
     converter = RedCloth.new(textile|| '')
     converter.hard_breaks = false
-    @@sanitizer.sanitize(converter.to_html)
+    sanitize_html(converter.to_html, :white_list)
   end
 end
@@ -21,18 +21,18 @@
   </div>
 <% end %>
-<%= form_tag '#', :method => 'get' do %>
-  <%= field_set_tag _('Filter'), :class => 'filter_fields' do %>
-    <p>
-      <%= labelled_select(_('Type of task')+': ', :filter_type, :first, :last, @filter_type,  type_collection, {:id => 'filter-type'}) %>
-    </p>
-    <p>
-      <%= labelled_text_field(_("Text filter")+': ', :filter_text, nil, {:id => 'filter-text',:value => @filter_text}) %>
-    </p>
-    <% if profile.organization? %>
-      <p>
-        <%= labelled_select(_('Assigned to')+': ', :filter_responsible, :id, :name, @filter_responsible, [OpenStruct.new(:name => _('All'), :id => nil), OpenStruct.new(:name => _('Unassigned'), :id => -1)] + @responsible_candidates, :class => 'filter_responsible') %>
-      </p>
+<%= form_tag '#', :method => 'post' do %>
+
+    <%= field_set_tag _('Filter'), :class => 'filter_fields' do %>
+        <p>
+          <%= labelled_select(_('Type of task')+': ', :filter_type, :first, :last, @filter_type,  type_collection, {:id => 'filter-type'}) %>
+        </p>
+        <p>
+          <%= labelled_text_field(_("Text filter")+': ', :filter_text, nil, {:id => 'filter-text-autocomplete',:value => @filter_text}) %>
+        </p>
+        <p>
+          <%= submit_button(:search, _('Search')) %>
+        </p>
     <% end %>
     <p>
       <%= labelled_select(_('Tags')+': ', :filter_tags, :id, :name, @filter_tags, @task_tags, {:id => 'filter-add-tag'}) %>
@@ -44,7 +44,6 @@
     </p>
   <% end %>
 <% end %>
-
 <% if @tasks.empty? %>
   <p>
     <em><%= _('No pending tasks for %s') % profile.name %></em>
@@ -64,7 +63,7 @@
         <p>
         <%= labelled_select(_("Set all to: "), 'set-decisions', 'first', 'last', nil, [['',""],['accept',_("Accept")],['reject',_("Reject")],['skip',_("Skip")]], :id => "up-set-all-tasks-to") %>
         </p>
-      <% end %>
+    <% end %>
       <div class="task_boxes">
         <% @tasks.each do |task| %>
@@ -73,11 +72,11 @@
       </div>
       <% unless @view_only %>
-        <p>
-        <%= labelled_select(_("Set all to: "), 'set-decisions', 'first', 'last', nil, [['',""],['accept',_("Accept")],['reject',_("Reject")],['skip',_("Skip")]], :id => "down-set-all-tasks-to") %>
-        </p>
+          <p>
+          <%= labelled_select(_("Set all to: "), 'set-decisions', 'first', 'last', nil, [['',""],['accept',_("Accept")],['reject',_("Reject")],['skip',_("Skip")]], :id => "down-set-all-tasks-to") %>
+          </p>
       <% end %>
-    </ul>
+        </ul>
     <script>
       jQuery('.tag-list').inputosaurus({
@@ -15,6 +15,21 @@ module Noosfero
     require 'noosfero/plugin'
+    # The plugin xss_terminator(located in vendor/plugins/xss_terminator) and the helper
+    # SanitizeHelper(located in app/helpers/sanitize_helper.rb) use
+    # ALLOWED_TAGS and ALLOWED_ATTRIBUTES to make a sanitize with html.
+
+    ALLOWED_TAGS = %w(object embed param table tr th td applet comment iframe audio video source
+    strong em b i p code pre tt samp kbd var sub sup dfn cite big small address hr br div span h1
+    h2 h3 h4 h5 h6 ul ol li dl dt dd abbr acronym a img blockquote del ins a)
+
+    ALLOWED_ATTRIBUTES = %w(name href cite class title src xml:lang height datetime alt abbr width
+      vspace hspace heigth value type data style target codebase archive data-macro align border
+      classid code flashvars scrolling frameborder controls autoplay colspan id rowspan)
+
+    config.action_view.sanitized_allowed_tags = ALLOWED_TAGS
+    config.action_view.sanitized_allowed_attributes = ALLOWED_ATTRIBUTES
+
     require 'noosfero/multi_tenancy'
     config.middleware.use Noosfero::MultiTenancy::Middleware
@@ -1,14 +0,0 @@
-require 'loofah/helpers'
-
-ActionView::Base.full_sanitizer = Loofah::Helpers::ActionView::FullSanitizer.new
-ActionView::Base.white_list_sanitizer = Loofah::Helpers::ActionView::WhiteListSanitizer.new
-
-Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS_WITH_LIBXML2.merge %w[
-  img object embed param table tr th td applet comment iframe audio video source
-]
-
-Loofah::HTML5::WhiteList::ALLOWED_ATTRIBUTES.merge %w[
-  align border alt vspace hspace width heigth value type data
-  style target codebase archive classid code flashvars scrolling frameborder controls autoplay colspan
-]
-
@@ -2,40 +2,40 @@ module SanitizeParams
   protected
-    # Check each request parameter for 
-    # improper HTML or Script tags
-    def sanitize_params
-      sanitize_params_hash(request.params)    
-    end
+  # Check each request parameter for
+  # improper HTML or Script tags
+  def sanitize_params
+    sanitize_params_hash(params)
+  end
-    # Given a params list sanitize all
-    def sanitize_params_hash(params)
-      params.each { |k, v|
-        if v.is_a?(String)        
-          params[k] = sanitize_param v
-        elsif v.is_a?(Array)
-          params[k] = sanitize_array v
-        elsif v.kind_of?(Hash)
-          params[k] = sanitize_params_hash(v)
-        end
-      }    
-    end
+  # Given a params list sanitize all
+  def sanitize_params_hash(params)
+    params.each { |k, v|
+      if v.is_a?(String)
+        params[k] = sanitize_param v
+      elsif v.is_a?(Array)
+        params[k] = sanitize_array v
+      elsif v.kind_of?(Hash)
+        params[k] = sanitize_params_hash(v)
+      end
+    }
+  end
-    # If the parameter was an array, 
-    # try to sanitize each element in the array
-    def sanitize_array(array)
-      array.map! { |e| 
-        if e.is_a?(String)
-          sanitize_param e
-        end
-      }
-      return array
-    end
+  # If the parameter was an array,
+  # try to sanitize each element in the array
+  def sanitize_array(array)
+    array.map! { |e|
+      if e.is_a?(String)
+        sanitize_param e
+      end
+    }
+    return array
+  end
-    # Santitize a single value
-    def sanitize_param(value)
-      allowed_tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p)
-      ActionController::Base.helpers.sanitize(value, tags: allowed_tags, attributes: %w(href title))
-    end
+  # Santitize a single value
+  def sanitize_param(value)
+    allowed_tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p)
+    ActionController::Base.helpers.sanitize(value, tags: allowed_tags, attributes: %w(href title))
+  end
-end    
+end
@@ -788,15 +788,18 @@ class SearchControllerTest &lt; ActionController::TestCase
     injection = '<iMg SrC=x OnErRoR=document.documentElement.innerHTML=1>SearchParam'
     get :tag, :tag => injection
     tag = assigns(:tag)
-    assert !tag.upcase.include?('IMG') && tag.include?('SearchParam')
+    assert !tag.upcase.include?('IMG')
+    assert tag.include?('SearchParam')
   end
-  should 'not allow query injection array' do
-    injection = ['<iMg SrC=x OnErRoR=document.documentElement.innerHTML=1>', '<script>document.innerHTML = \'x\'</script>']
+  should 'not allow query injection in array' do
+    injection = ['<iMg SrC=x OnErRoR=document.documentElement.innerHTML=1>',
+                 '<script>document.innerHTML = \'x\'</script>']
     get :tag, :tag => injection
     tag = assigns(:tag)
-    tag.each { |t| 
-      assert !t.upcase.include?('IMG') && !t.upcase.include?('SCRIPT') 
+    tag.each { |t|
+      assert !t.upcase.include?('IMG')
+      assert !t.upcase.include?('SCRIPT')
     }
   end
@@ -4,6 +4,7 @@ require &#39;tasks_controller&#39;
 class TasksControllerTest < ActionController::TestCase
   self.default_params = {profile: 'testuser'}
+
   def setup
     @controller = TasksController.new
     @request    = ActionController::TestRequest.new
@@ -28,12 +29,12 @@ class TasksControllerTest &lt; ActionController::TestCase
   end
   should 'get filtered tasks to autocomplete text field' do
-
+ 
     #Create a admin user and a simple user
     profile_admin = create_user('admin_tester').person
     Environment.default.add_admin(profile_admin)
     user = fast_create(Person,:name => 'FakeUser')
-
+ 
     #Create a task of type 'ModerateUserRegistration'
     task_data = {
         :target => Environment.default,
@@ -41,20 +42,20 @@ class TasksControllerTest &lt; ActionController::TestCase
         :data => {:user_id => user.id,:name => user.name}
     }
     ModerateUserRegistration.create!(task_data)
-
+ 
     #Use admin user to your profile with a pending task above
     @controller.stubs(:profile).returns(profile_admin)
     login_as profile_admin.identifier
-
+ 
     #Perform a http request to 'search_task' action with params
     post :search_tasks, :filter_type =>'ModerateUserRegistration', :filter_text => 'Fak'
-
+ 
     assert_response :success
-
+ 
     #Check if json response matches with a 'FakeUser'
     json_response = ActiveSupport::JSON.decode(@response.body)
     value = json_response[0]['value']
-
+ 
     assert_equal value, 'FakeUser'
   end
@@ -468,13 +469,13 @@ class TasksControllerTest &lt; ActionController::TestCase
     t2 = CleanHouse.create!(:requestor => requestor, :target => profile)
     t3 = FeedDog.create!(:requestor => requestor, :target => profile)
-    get :index, :filter_type => t1.type, :filter_text => 'test'
+    post :index, :filter_type => t1.type, :filter_text => 'test'
     assert_includes assigns(:tasks), t1
     assert_not_includes assigns(:tasks), t2
     assert_not_includes assigns(:tasks), t3
-    get :index
+    post :index
     assert_includes assigns(:tasks), t1
     assert_includes assigns(:tasks), t2
 module XssTerminate
-  ALLOWED_CORE_ATTRIBUTES = %w(name href cite class title src xml:lang height datetime alt abbr width)
-  ALLOWED_CUSTOM_ATTRIBUTES = %w(data-macro)
   def self.sanitize_by_default=(value)
     @@sanitize_by_default = value
@@ -40,30 +38,33 @@ module XssTerminate
   module InstanceMethods
-    def sanitize_allowed_attributes
-      ALLOWED_CORE_ATTRIBUTES | ALLOWED_CUSTOM_ATTRIBUTES
-    end
-
     def sanitize_field(sanitizer, field, serialized = false)
       field = field.to_sym
       if serialized
         puts field
         self[field].each_key { |key|
           key = key.to_sym
-          self[field][key] = sanitizer.sanitize(self[field][key], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes)
+          self[field][key] = sanitizer.sanitize(self[field][key], encode_special_chars: false, scrubber: permit_scrubber )
         }
       else
         if self[field]
-          self[field] = sanitizer.sanitize(self[field], scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes)
+          self[field] = sanitizer.sanitize(self[field], encode_special_chars: false, scrubber: permit_scrubber )
         else
           value = self.send("#{field}")
           return unless value
-          value = sanitizer.sanitize(value, scrubber: Rails::Html::PermitScrubber.new, encode_special_chars: false, attributes: sanitize_allowed_attributes)
+          value = sanitizer.sanitize(value, encode_special_chars: false, scrubber: permit_scrubber)
           self.send("#{field}=", value)
         end
       end
     end
+    def  permit_scrubber
+        scrubber = Rails::Html::PermitScrubber.new
+        scrubber.tags = Rails.application.config.action_view.sanitized_allowed_tags
+        scrubber.attributes = Rails.application.config.action_view.sanitized_allowed_attributes
+        scrubber
+    end
+
     def sanitize_columns(with = :full)
       columns_serialized = self.class.serialized_attributes.keys
       only = eval "xss_terminate_#{with}_options[:only]"
@@ -75,27 +76,20 @@ module XssTerminate
     end
     def sanitize_fields_with_full
-      sanitizer = Rails::Html::FullSanitizer.new
-      columns, columns_serialized = sanitize_columns(:full)
-      columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
-      end
+      sanitize_fields_with(Rails::Html::FullSanitizer.new,:full)
     end
     def sanitize_fields_with_white_list
-      sanitizer = Rails::Html::WhiteListSanitizer.new
-      columns, columns_serialized = sanitize_columns(:white_list)
-      columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
-      end
-   end
+      sanitize_fields_with(Rails::Html::WhiteListSanitizer.new,:white_list)
+    end
     def sanitize_fields_with_html5lib
-      sanitizer = HTML5libSanitize.new
-      columns = sanitize_columns(:html5lib)
-      columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
-      end
+      sanitize_fields_with(HTML5libSanitize.new,:html5lib)
+    end
+
+    def sanitize_fields_with sanitizer, type
+      columns, columns_serialized = sanitize_columns(type)
+      columns.each {|column| sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))}
     end
   end
	@@ -66,7 +66,7 @@ module CommentHelper		@@ -66,7 +66,7 @@ module CommentHelper
66		66
67	def link_for_edit(comment)	67	def link_for_edit(comment)
68	if comment.can_be_updated_by?(user)	68	if comment.can_be_updated_by?(user)
69	- {:link => expirable_comment_link(comment, :edit, _('Edit'), url_for(:profile => profile.identifier, :controller => :comment, :action => :edit, :id => comment.id),:class => 'modal')}	69	+ {:link => expirable_comment_link(comment, :edit, _('Edit'), url_for(:profile => profile.identifier, :controller => :comment, :action => :edit, :id => comment.id), :modal => true)}
70	end	70	end
71	end	71	end
72		72
@@ -0,0 +1,25 @@		@@ -0,0 +1,25 @@
	1	+module SanitizeHelper
	2	+
	3	+ def sanitize_html(text, type= :full_sanitize)
	4	+ sanitizer(type).sanitize(text, scrubber: permit_scrubber)
	5	+ end
	6	+
	7	+ def sanitize_link(text)
	8	+ sanitizer(:white_list).sanitize(text, scrubber:permit_scrubber)
	9	+ end
	10	+
	11	+protected
	12	+
	13	+ def permit_scrubber
	14	+ scrubber = Rails::Html::PermitScrubber.new
	15	+ scrubber.tags = Rails.application.config.action_view.sanitized_allowed_tags
	16	+ scrubber.attributes = Rails.application.config.action_view.sanitized_allowed_attributes
	17	+ scrubber
	18	+ end
	19	+
	20	+ def sanitizer type = :full_sanitize
	21	+ return HTML::WhiteListSanitizer.new if type == :white_list
	22	+ HTML::FullSanitizer.new
	23	+ end
	24	+
	25	+end
	@@ -347,6 +347,7 @@ class Task < ActiveRecord::Base		@@ -347,6 +347,7 @@ class Task < ActiveRecord::Base
347	where [environment_condition, profile_condition].compact.join(' OR ')	347	where [environment_condition, profile_condition].compact.join(' OR ')
348	}	348	}
349		349
		350	+
350	def self.pending_types_for(profile)	351	def self.pending_types_for(profile)
351	Task.to(profile).pending.select('distinct type').map { \|t\| [t.class.name, t.title] }	352	Task.to(profile).pending.select('distinct type').map { \|t\| [t.class.name, t.title] }
352	end	353	end
	@@ -15,6 +15,21 @@ module Noosfero		@@ -15,6 +15,21 @@ module Noosfero
15		15
16	require 'noosfero/plugin'	16	require 'noosfero/plugin'
17		17
		18	+ # The plugin xss_terminator(located in vendor/plugins/xss_terminator) and the helper
		19	+ # SanitizeHelper(located in app/helpers/sanitize_helper.rb) use
		20	+ # ALLOWED_TAGS and ALLOWED_ATTRIBUTES to make a sanitize with html.
		21	+
		22	+ ALLOWED_TAGS = %w(object embed param table tr th td applet comment iframe audio video source
		23	+ strong em b i p code pre tt samp kbd var sub sup dfn cite big small address hr br div span h1
		24	+ h2 h3 h4 h5 h6 ul ol li dl dt dd abbr acronym a img blockquote del ins a)
		25	+
		26	+ ALLOWED_ATTRIBUTES = %w(name href cite class title src xml:lang height datetime alt abbr width
		27	+ vspace hspace heigth value type data style target codebase archive data-macro align border
		28	+ classid code flashvars scrolling frameborder controls autoplay colspan id rowspan)
		29	+
		30	+ config.action_view.sanitized_allowed_tags = ALLOWED_TAGS
		31	+ config.action_view.sanitized_allowed_attributes = ALLOWED_ATTRIBUTES
		32	+
18	require 'noosfero/multi_tenancy'	33	require 'noosfero/multi_tenancy'
19	config.middleware.use Noosfero::MultiTenancy::Middleware	34	config.middleware.use Noosfero::MultiTenancy::Middleware
20		35
	@@ -1,14 +0,0 @@	@@ -1,14 +0,0 @@
1	-require 'loofah/helpers'
2	-
3	-ActionView::Base.full_sanitizer = Loofah::Helpers::ActionView::FullSanitizer.new
4	-ActionView::Base.white_list_sanitizer = Loofah::Helpers::ActionView::WhiteListSanitizer.new
5	-
6	-Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS_WITH_LIBXML2.merge %w[
7	- img object embed param table tr th td applet comment iframe audio video source
8	-]
9	-
10	-Loofah::HTML5::WhiteList::ALLOWED_ATTRIBUTES.merge %w[
11	- align border alt vspace hspace width heigth value type data
12	- style target codebase archive classid code flashvars scrolling frameborder controls autoplay colspan
13	-]
14	-