Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SanitizeHTMLDocument ¶
SanitizeHTMLDocument sanitizes an HTML document body using the permissive HTML document policy. The iframeAllowlist controls which domains are allowed in iframe src attributes.
func ValidateHTMLDocument ¶
ValidateHTMLDocument validates that the HTML document is non-empty and does not contain script tags or event handler attributes. It returns an error if the document is invalid.
func ValidateTipTapDocument ¶
ValidateTipTapDocument checks a decoded TipTap document tree for structural validity (node types, required attributes, depth limits).
Types ¶
type Sanitizer ¶
type Sanitizer struct {
// contains filtered or unexported fields
}
Sanitizer applies the kernel HTML policies: strict plain-text stripping and rich-HTML sanitization with safe links.
func NewSanitizer ¶
func NewSanitizer() *Sanitizer
NewSanitizer builds a Sanitizer with the default policies.
func (Sanitizer) ContainsHTML ¶
ContainsHTML reports whether value contains an actual HTML tag (an opening "<" immediately followed by a tag-name letter, a "/" for closing tags, or a "!" for comments/DOCTYPE). It deliberately does NOT treat a bare "&" or a straight "'" as HTML: bluemonday's strict policy escapes those to "&"/"'", so a previous "did the sanitizer change the input?" heuristic false-positived on real titles like "Install & first content" or "roaster's". Plain text that merely contains an ampersand, an apostrophe, or a math "<" is left alone.
func (Sanitizer) SanitizeHTMLWithSafeLinks ¶
SanitizeHTMLWithSafeLinks sanitizes rich HTML and keeps only safe links.
func (Sanitizer) SanitizePlainText ¶
SanitizePlainText strips all HTML, leaving plain text.
func (Sanitizer) SanitizeRichHTML ¶
SanitizeRichHTML sanitizes rich HTML while allowing safe inline markup.
Source Files