gistfile1.rb

require 'sanitize'

class Roda
  module RodaPlugins
    # The h plugin adds an +h+ instance method that will HTML
    # escape the input and return it.
    #
    # The following example will return "<foo>" as the body.
    #
    #   plugin :h
    #
    #   route do |r|
    #     h('<foo>')
    #   end
    module Sanitize
      OPTS = {}.freeze

      def self.configure(app, opts=OPTS)
        app.opts[:sanitizer] = ::Sanitize.new(opts)
      end

      module ClassMethods
        def sanitizer
          opts[:sanitizer]
        end
      end

      module InstanceMethods
        def s
          self.class.sanitizer
        end
      end

      module RequestMethods
        def sanitize!(fields)
          s = roda_class.sanitizer

          fields.each do |field|
            params[field] = s.fragment(params[field])
          end
        end
      end
    end

    register_plugin(:sanitize, Sanitize)
  end
end