Loofah is a Ruby library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In production it functions primarily as the HTML sanitization engine behind Rails (via rails-html-sanitizer) and countless other Ruby web applications: it parses untrusted user-supplied HTML and scrubs out unsafe tags, attributes, URLs, CSS properties, and protocols while preserving safe markup. The library combines a general-purpose transformation framework (custom 'scrubbers') with a specific html5lib-derived sanitizer safelist covering HTML, MathML, and SVG elements, ARIA attributes, CSS properties/functions, and URI protocols. The codebase deliberately supports both HTML4 (libxml2) and HTML5 (gumbo) parsing paths, and is the de facto standard for server-side HTML sanitization in the Ruby ecosystem.