kaspth

def css_select(*args)
  # See assert_select to understand what's going on here.
  arg = args.shift

  if arg.is_a?(HTML::Node)
    root = arg
    arg = args.shift
  elsif arg == nil
    raise ArgumentError, "First argument is either selector or element to select, but nil found. Perhaps you called assert_select with an element that does not exist?"
  elsif defined?(@selected) && @selected

kaspth

# In actionview dir run tests with
# rake test TEST=test/template/sanitizers_test.rb

  1) Failure:
SanitizerTest#test_should_not_fall_for_xss_image_hack_4 [actionview/test/template/sanitizers_test.rb:173]:
Expected: "<img>"
  Actual: "<img>alert(\"XSS\")\"&gt;"


  2) Failure:

kaspth

# By switching out the html-scanner lib with Loofah, we can make use of the custom HTML scrubbers within Loofah to get more control over what gets sanitized.

# This could be useful in apps where users submit text content.
# Say Twitter in an alternate universe allows users to format their tweets using some HTML tags. They then need a way to specify what tags are black- and/or whitelisted.

# This is an example of how it could work in a model.
class Comment < ActiveRecord::Base
  # block based
  # block takes a node
  scrubs :body do |node|