actiontext-richtext

ActionText (Rich Text)

Add rich text editing to Rails models. Trix editor + ActionText + ActiveStorage handle the editor, storage, and embedded attachments. Default Rails 8 has decent defaults — the gotchas are around sanitization, search indexing, and custom embeds.

The opinion

has_rich_text :body on the model. Trix is the default editor — fine for most cases. Sanitize on output (Rails does by default). Index the plain-text representation, not the HTML. For custom embeds (mentions, polls), use ActionText's attachable mixin. Don't migrate to TinyMCE/CKEditor unless you have a specific need — Trix's smaller surface area is a security win.

Counter-positions:

• TinyMCE / CKEditor / Tiptap — more powerful editors. Larger XSS attack surface, separate licensing. Pick only if Trix is genuinely insufficient.

Setup

bin/rails action_text:install
bin/rails db:migrate

Creates action_text_rich_texts and active_storage_blobs/attachments tables.

Core patterns

Pattern 1: Model + form

class Post < ApplicationRecord
  has_rich_text :body
end

<%= form.label :body %>
<%= form.rich_text_area :body %>

<!-- View -->
<%= @post.body %>  <!-- Renders the rendered Trix HTML, sanitized -->

Pattern 2: Sanitization (the default + custom)

Rails sanitizes ActionText output by default. The allowed tags include common formatting (<strong>, <em>, <h1-6>, <a>, <img>, etc.) — see Rails::Html::SafeListSanitizer for the exact list.

To restrict further:

# config/initializers/action_text.rb
ActionText::ContentHelper.allowed_tags -= %w[h1 h2]

To allow more (carefully):

ActionText::ContentHelper.allowed_tags += %w[mark]

Anti-pattern: allowing <script> (even by mistake). The default safe-list excludes it; never add.

Pattern 3: Embedded attachments

Trix supports drag-and-drop image upload. ActionText wires it to ActiveStorage automatically.

# Variant configured on the attachment association (Rails 7.1+):
class Post < ApplicationRecord
  has_rich_text :body
end

# config/application.rb — variant pipeline (libvips by default in Rails 7+)
# Rails.application.config.active_storage.variant_processor = :vips