From: Florian Gross <flgr@...>
Date: 2004-10-14T23:19:47+09:00
Subject: Re: HTML filtering in weblog/BBS software

Alexey Verkhovsky wrote:

> Hi all,

Moin!

> I am writing some sort of BBS in Ruby (on Rails). I downloaded and
> included RedCloth for template rendering (in 5 lines of code and 15
> lines of test - wow!). It's cool, but allows to include any HTML.

There's two options for not allowing user-specified HTML and style 
sheets. (Even style sheets can contain JavaScript.) Just use RedCloth 
like this:

RedCloth.new("h1. A <b>bold</b> man", [:filter_html, :filter_styles])
# => "<h1>A &lt;b&gt;bold&lt;/b&gt; man</h1>"

BlueCloth and RDoc have similar options AFAIK.

Regards,
Florian Gross