Use Loofah::HTML5::SafeList where possible

TracksApp · Feb 8, 2020 · 7269758 · 7269758
1 parent 6fcf7e6
commit 7269758
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/config/initializers/sanitizer.rb b/config/initializers/sanitizer.rb
@@ -1 +1,10 @@
-Loofah::HTML5::WhiteList::ALLOWED_PROTOCOLS.merge(%w(message onenote))
+# From Loofah 2.3.0, we should use Loofah::HTML5::SafeList over
+# Loofah::HTML5::WhiteList
+safe_list =
+  if Loofah::HTML5.constants.include?(:SafeList)
+    Loofah::HTML5::SafeList
+  else
+    Loofah::HTML5::WhiteList
+  end
+
+safe_list::ALLOWED_PROTOCOLS.merge(%w(message onenote))