Documentation
¶
Overview ¶
Package sanitize supplies immutable HTML fragment allowlists backed by bluemonday. Output is for HTML body content, not scripts, CSS, URLs or attributes.
Index ¶
Constants ¶
View Source
const MaxInputBytes = 1 << 20
View Source
const MaxOutputBytes = 4 << 20
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Config ¶
type Config struct {
AllowedTags []string
InputBytes int
OutputBytes int
// AdditionalURLSchemes accepts only URLSchemeTel. Unknown values and
// duplicates are invalid; the default HTTP, HTTPS and mailto schemes cannot be added.
AdditionalURLSchemes []URLScheme
// AllowRelativeURLs permits local paths, queries and fragments. Protocol-relative
// URLs (//host) and backslash authority prefixes remain forbidden.
AllowRelativeURLs bool
}
Config configures allowed HTML tags, URLs and byte budgets.
func DefaultConfig ¶
func DefaultConfig() Config
DefaultConfig returns default tags and byte budgets, with only HTTP, HTTPS and mailto URLs allowed and relative URLs disabled.
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy never exposes the mutable third-party builder. It is safe for concurrent calls after construction. No CSS, event handlers, data attributes, forms, embedded documents, SVG/MathML, data URLs or script-capable tags are admitted.
Source Files
Click to show internal directories.
Click to hide internal directories.