sanitize is such an overused method name that it binds to a lot of different things. Because datatables inherit from AjaxDatatablesRails::ActiveRecord which inherits from AjaxDatatablesRails::Base for some odd reason sanitize binds to ActionView's sanitize method which eventually gets to Loofah and Nokogiri which doesn't handle arrays and throws the error I reported in #325 surprisingly even when you call self.sanitize it does not call the method in the same namespace and file!! because technically the sanitize function that we want is AjaxDatatablesRails::Base's function, to disabiguate we could either rename the function (and because I don't know what else calls it that seemed like a bad idea), or we could help disambiguate by being explicit about which super's method to call. The only way I saw to do this is to call it like this: AjaxDatatablesRails::Base.instance_method(:sanitize).bind(self).call(data). That may make for unreadable code to some, we could always define another method that then calls AjaxDatatablesRails::Base.instance_method(:sanitize).bind(self).call(data). Or if you have another way to fix, have at it. But this breaks in Ruby 2.4.0 and rails 5.2.3 for me without this change.

Author: epipheus

lib/ajax-datatables-rails/base.rb

@@ -33,7 +33,7 @@ def as_json(*)
       {
         recordsTotal:    records_total_count,
         recordsFiltered: records_filtered_count,
-        data:            sanitize(data),
+        data:            AjaxDatatablesRails::Base.instance_method(:sanitize).bind(self).call(data),
       }.merge(get_additional_data)
     end