仅允许从用户输入显示链接(Only allow links to display from user input)

仅允许从用户输入显示链接(Only allow links to display from user input)

My Rails应用程序允许用户发布使用simple_format显示的注释。 目前所有的html都已转义，但我希望用户能够在评论中发布链接。 看看这里讨论的rails_autolink gem我应该能够做到这一点，但我不知道这是否是最好/最安全的方法。

宝马说，auto_link已从rails中删除

这是从rails中提取auto_link方法。 在版本Rails 3.1中从Rails中删除了auto_link方法。 这个宝石旨在填补人们迁移的空白。

我应该如何仅允许在我的评论中显示链接？

My Rails app allows users to post comments which are displayed with simple_format. Currently all html is escaped but I'd like for users to be able to post links in their comments. Looking at the rails_autolink gem discussed here I should be able to do this but I don't know if this is the best/safest method.

auto_link was removed from rails and the gem says

This is an extraction of the auto_link method from rails. The auto_link method was removed from Rails in version Rails 3.1. This gem is meant to bridge the gap for people migrating.

How should I allow only links to be shown in my comments?

最满意答案

使用Sanitize 。

标签和属性（只允许提到的标签和属性，没有别的）。

<%= sanitize @article.body, tags: %w(a) %>

这是文档 。

Use Sanitize.

Tags and attributes (only the mentioned tags and attributes are allowed, nothing else).

<%= sanitize @article.body, tags: %w(a) %>

Here is the documentation.