<commit_before>= Loofah

* http://loofah.rubyforge.org
* http://rubyforge.org/projects/loofah
* http://github.com/flavorjones/loofah

== Description

Loofah is a general library for manipulating HTML/XML documents and
fragments. It's built on top of Nokogiri and libxml2, so it's fast and
has a nice API.

Loofah excels at HTML sanitization (XSS prevention). It includes some
nice HTML sanitizers, which are based on HTML5lib's whitelist, so it
most likely won't make your codes less secure. (These statements have
not been evaluated by Netexperts.)

== Features

* Easily write custom scrubbers for HTML/XML leveraging the sweetness of Nokogiri (and HTML5lib's whitelists).
* Common HTML sanitizing tasks are built-in:
  * _Strip_ unsafe tags, leaving behind only the inner text.
  * _Prune_ unsafe tags and their subtrees, removing all traces that they ever existed.
  * _Escape_ unsafe tags and their subtrees, leaving behind lots of <tt>&lt;</tt> and <tt>&gt;</tt> entities.
  * _Whitewash_ the markup, removing all attributes and namespaced nodes.
* Common HTML transformation tasks are built-in:
  * Add the _nofollow_ attribute to all hyperlinks.
* Format markup as plain text.
* Replace Rails's +strip_tags+ and +sanitize+ helper methods.
* Two ActiveRecord extensions:
  * Loofah::XssFoliate, an XssTerminate[http://github.com/look/xss_terminate/tree/master] drop-in replacement, is an *opt-out* sanitizer. By default all models and attributes are sanitized.
  * Loofah::ActiveRecordExtension is an *opt-in* sanitizer. You must explicitly declare attributes to be sanitized.

== Compare and Contrast

Loofah is the only Ruby XSS/sanitization solution that guarantees
well-formed and valid markup.

Loofah works fine on XML, XHTML and HTML documents.

Also, it's pretty fast. Here is a benchmark comparing Loofah to other
commonly-used libraries (ActionView, Sanitize and HTML5lib):

* http://gist.github.com/170193

Lastly, Loofah is extensible. It's super-easy to write your own custom
scrubbers for whatever document manipulation you need. You don't like
the built-in scrubbers? Build your own, like a boss.

== The Basics

Loofah wraps Nokogiri[http://nokogiri.org] in a loving
embrace. Nokogiri[http://nokogiri.org] is an excellent HTML/XML
parser. If you don't know how Nokogiri[http://nokogiri.org] works, you
might want to pause for a moment and go check it out. I'll wait.

Loofah presents the following classes:
<commit_msg>updating README to note that Sanitize also uses Nokogiri, and hence has well-formed output.<commit_after>= Loofah

* http://loofah.rubyforge.org
* http://rubyforge.org/projects/loofah
* http://github.com/flavorjones/loofah

== Description

Loofah is a general library for manipulating HTML/XML documents and
fragments. It's built on top of Nokogiri and libxml2, so it's fast and
has a nice API.

Loofah excels at HTML sanitization (XSS prevention). It includes some
nice HTML sanitizers, which are based on HTML5lib's whitelist, so it
most likely won't make your codes less secure. (These statements have
not been evaluated by Netexperts.)

== Features

* Easily write custom scrubbers for HTML/XML leveraging the sweetness of Nokogiri (and HTML5lib's whitelists).
* Common HTML sanitizing tasks are built-in:
  * _Strip_ unsafe tags, leaving behind only the inner text.
  * _Prune_ unsafe tags and their subtrees, removing all traces that they ever existed.
  * _Escape_ unsafe tags and their subtrees, leaving behind lots of <tt>&lt;</tt> and <tt>&gt;</tt> entities.
  * _Whitewash_ the markup, removing all attributes and namespaced nodes.
* Common HTML transformation tasks are built-in:
  * Add the _nofollow_ attribute to all hyperlinks.
* Format markup as plain text.
* Replace Rails's +strip_tags+ and +sanitize+ helper methods.
* Two ActiveRecord extensions:
  * Loofah::XssFoliate, an XssTerminate[http://github.com/look/xss_terminate/tree/master] drop-in replacement, is an *opt-out* sanitizer. By default all models and attributes are sanitized.
  * Loofah::ActiveRecordExtension is an *opt-in* sanitizer. You must explicitly declare attributes to be sanitized.

== Compare and Contrast

Loofah is one of two known Ruby XSS/sanitization solutions that
guarantees well-formed and valid markup (the other is Sanitize, which
also uses Nokogiri).

Loofah works fine on XML, XHTML and HTML documents.

Also, it's pretty fast. Here is a benchmark comparing Loofah to other
commonly-used libraries (ActionView, Sanitize, HTML5lib and HTMLfilter):

* http://gist.github.com/170193

Lastly, Loofah is extensible. It's super-easy to write your own custom
scrubbers for whatever document manipulation you need. You don't like
the built-in scrubbers? Build your own, like a boss.

== The Basics

Loofah wraps Nokogiri[http://nokogiri.org] in a loving
embrace. Nokogiri[http://nokogiri.org] is an excellent HTML/XML
parser. If you don't know how Nokogiri[http://nokogiri.org] works, you
might want to pause for a moment and go check it out. I'll wait.

Loofah presents the following classes:

{'fraction_non_alphanumeric': 0.07530300019868866, 'fraction_numerical': 0.00397377309755613, 'mean_word_length': 4.587125416204217, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2911229', 'n_tokens_mistral': 1574, 'n_tokens_neox': 1488, 'n_words': 644}