dominikmifkovic/detoxss/1.0.0

Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/dominikmifkovic/detoxss is gone (deleted or private); Software Heritage has not archived the repo; no fork with the same repo name found; no cached copy. Use another version.

Details

DetoXSS.ExprParser

Tolerant parser for HTML-like input.

This module converts an input string into a lightweight tree representation used by the AST analyzer. It is intentionally tolerant because security-related input can be malformed, incomplete, or intentionally obfuscated.

Most users should use the higher-level functions in DetoXSS.Ast instead of calling this parser directly.

Parse an HTML-like string into a list of lightweight nodes.

The parser is tolerant and is intended for security analysis rather than browser-exact HTML parsing.

parseExpression "<p>Hello</p>"
type Parsed
= Ok (List HtmlNode)
| Err String

Result of parsing an HTML-like input.

Ok contains parsed HTML-like nodes. Err contains a parser error message.

This type is intentionally small because the parser is used as an internal analysis step for XSS detection.

= Element
{ tag : String
, attributes : List HtmlAttribute
, children : List HtmlNode
, position : Position
}
| Text
{ content : String
, position : Position
}
| Comment
{ content : String
, position : Position
}

Lightweight HTML-like node representation.

The parser distinguishes element nodes, text nodes, and comments. Element nodes contain a tag name, attributes, child nodes, and source position.

type alias HtmlAttribute =
{ name : String
, value : String
, position : Position
}

HTML-like attribute representation.

Each attribute contains its normalized name, parsed value, and source position. Boolean attributes are represented with an empty string as their value.

type alias Position =
{ row : Int
, col : Int
}

Source position in the parsed input.

The position stores row and column numbers reported by the Elm parser.