htmlpolicy

Overview ¶

Command htmlpolicy applies an HTML sanitization policy to HTML content.

Usage:

htmlpolicy [flags] <policy-arg>... < input.html > output.html

Each argument is either a path to a policy file or inline policy text. Arguments that refer to existing regular files are included (with include directives resolving relative to the file's directory). Other arguments (inline text, or paths that are not regular files) are appended as inline policy lines. Multiple arguments are concatenated in order.

HTML is read from stdin and sanitized output is written to stdout.

Flags:

-fragment          Parse input as an HTML fragment instead of a full document
-detect-charset    Detect and convert input charset to UTF-8
-content-type      Content-Type header for charset detection (only used with -detect-charset)
-prefix            Override the prefix used by comment-out and every defang action
-lint              Check the policy for likely mistakes and exit (does not read stdin)
-verbose           Log each sanitization action to stderr

With -lint, a policy that produces warnings exits 1 — the same status as a policy that fails to parse — so a CI check can treat any non-zero exit as "policy needs attention". A clean policy prints a confirmation to stderr and exits 0.