If you've developed an application that displays user-supplied text in a Web browser, it's always possible that the user has entered some crazy HTML (or even CSS) that will break your site's layout. While it's easy to remove all HTML from a piece of text, you might want them to use certain subsets of HTML to format their content, so you need to sanitize the user supplied HTML and CSS. Luckily, two Ruby libraries have been released in the last couple of days to sanitize HTML and CSS respectively.

HTML

Sanitize (or Github repo) by Ryan Grove is a new HTML sanitization library for Ruby. Install the sanitize gem and then it's crazily simple from there:

require 'rubygems'
require 'sanitize'

html = %{<strong><a href="http://foo.com/">foo</a></strong><img src="http://foo.com/bar.jpg" alt="" />}

Sanitize.clean(html) # => 'foo'

As Ryan explains in his blog post, Sanitize removes all HTML by default, but you can specify options to allow certain elements, attributes, protocols, and so forth - read his post to get the full scoop. Sanitize also closes tags that are left open - excellent!

CSS

Allowing users to specify custom CSS can be.. interesting (see MySpace) but potentially damaging if it gets sent to third parties. Browsers can, in many circumstances, execute JavaScript in CSS or otherwise be given nefarious CSS to parse. Courtenay Gasking's css_file_sanitize (or Github repo) helps prevent some of these issues by sanitizing the CSS provided. It's still in its earliest stages, and the README contains no documentation (but if you see his test file, you'll get the idea), so Courtenay's open for feedback, patches, etc.