sanitize属性白名单

app/helpers/application_helper.rb

@@ -21,9 +21,10 @@ module ApplicationHelper
         a abbr b bdo blockquote br caption cite code col colgroup dd del dfn dl
         dt em figcaption figure h1 h2 h3 h4 h5 h6 hgroup i img ins kbd li mark
         ol p pre q rp rt ruby s samp small strike strong sub sup table tbody td
-        tfoot th thead time tr u ul var wbr div span style
+        tfoot th thead time tr u ul var wbr div span
         )
-    sanitize content, tags: tags
+    attributes = %w(href src width height alt cite datetime title class name xml:lang abbr style)
+    sanitize content, tags: tags, attributes: attributes
   end
 
   def graduation_navigation graduation