Rails::HTML5: the strange and remarkable three-year journey
summary
A multi-year migration replaces an HTML4 sanitizer stack with HTML5-aware parsing so Rails 7.1 ships HTML5-compliant sanitizers by default. The work patches Nokogiri/libxml2, merges nokogumbo into nokogiri, adds HTML5 fragments to Loofah, and updates rails_html_sanitizer and Action View. Known mutation XSS exploits (select/style, SVG, MathML) drive the changes; Nokogiri HTML5 support takes ~1 year, Loofah ~6 months, and the integrated rollout completes in 2023 with libgumbo maintenance taken over.
AI-written summary · about
chapters (7)
- 0:00Introduction and security puzzle
- 4:03HTML 4 vs HTML 5 sanitizers
- 13:51Mutation XSS vulnerabilities explained
- 16:16Evolution of Rails sanitizer stack
- 23:22Nokogiri HTML5 support updates
- 24:47Loofah and Rails HTML sanitizer upgrades
- 27:36Rails 7.1 HTML5 sanitizer support
related talks
40mRails 5.1: Awesome Features and Breaking Changes
36mRails is Obsolete (But So's Everything Else)
12mWhimsy: Put That Test Down! You don't know where it's been
22mRiding Rails for decades
14mRails 5, Turbolinks 3, and the future of View-Over-the-Wire
34mThe Modern View Layer Rails Deserves: A Vision for 2025 and Beyond
23mRails Frontend Evolution: It Was a Setup All Along
53mRuby 2 in Ruby on Rails