Sanitizing CSS in Rails

Question

I want to allow the users of a web app that I\'m building to write their own CSS in order to customize their profile page.

However I am aware of this opening up for

Answer 1

Rails has a built-in css sanitizer

See http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize_css and its parent http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize

> ActionController::Base.helpers.sanitize_css('background:#fff')
=> "background: #fff;" 
> ActionController::Base.helpers.sanitize_css('javascript:alert("garr");')
=> ""