Preserve rel=me on links in rich text

[rails.git] / config / initializers / sanitize.rb

diff --git a/config/initializers/sanitize.rb b/config/initializers/sanitize.rb
index eb3039a132f70db038e6bb7b08bd6e4fb8e7af56..a6cce19a96633437469f0345c07a350825345511 100644 (file)
--- a/config/initializers/sanitize.rb
+++ b/config/initializers/sanitize.rb
@@ -1,5 +1,16 @@
-Sanitize::Config::OSM = Sanitize::Config::RELAXED.dup
+Sanitize::Config::OSM = Sanitize::Config.merge(
+  Sanitize::Config::RELAXED,
+  :elements => Sanitize::Config::RELAXED[:elements] - %w[div style],
+  :remove_contents => %w[script style],
+  :transformers => lambda do |env|
+    env[:node].remove_class
+    env[:node].kwattr_remove("style", nil)
+    env[:node].add_class("table table-sm w-auto") if env[:node_name] == "table"
 
-Sanitize::Config::OSM[:elements] -= [ 'div', 'style' ]
-Sanitize::Config::OSM[:add_attributes] = { 'a' => { 'rel' => 'nofollow' } }
-Sanitize::Config::OSM[:remove_contents] = [ 'script', 'style' ]
+    if env[:node_name] == "a"
+      rel = env[:node]["rel"] || ""
+
+      env[:node]["rel"] = rel.split.select { |r| r == "me" }.append("nofollow", "noopener", "noreferrer").sort.join(" ")
+    end
+  end
+)