[{"name":"DetoXSS.Ast","comment":" Static XSS-oriented analysis for HTML-like strings.\n\nThis module provides the main detection layer of the package. It classifies\ninput as `Safe`, `Suspicious`, or `Dangerous`, and can also return warnings\nexplaining why a value was considered risky.\n\nThe analyzer is intended for detection and decision making. It does not rewrite\nor sanitize the input by itself. For output sanitization, use\n`DetoXSS.Sanitize`.\n\n@docs Risk, Warning, RiskNode\n\n@docs classifyString, classifyBalanced, classifyExpression, classifyExpressionNode\n\n@docs scanBalanced, scanBalancedVerbose, scanExpression, scanExpressionNode\n\n@docs buildRiskTree, renderRiskTree\n\n@docs renderExpression, renderExpressionNode\n\n@docs fromStringToNode\n\n","unions":[{"name":"Risk","comment":" Risk classification returned by the analyzer.\n\n`Safe` means that no known risky pattern was found. `Suspicious` means that the\ninput contains potentially risky patterns. `Dangerous` means that a clear XSS\nindicator was detected.\n","args":[],"cases":[["Safe",[]],["Suspicious",[]],["Dangerous",[]]]},{"name":"RiskNode","comment":" Tree node annotated with XSS-related risk information.\n\n`selfWarnings` describe findings directly related to the current node.\n`aggregateRisk` also takes child nodes into account.\n","args":[],"cases":[["RiskNode",["{ node : DetoXSS.ExprParser.HtmlNode, selfWarnings : List.List DetoXSS.Ast.Warning, aggregateRisk : DetoXSS.Ast.Risk, children : List.List DetoXSS.Ast.RiskNode }"]]]}],"aliases":[{"name":"Warning","comment":" Warning produced by the analyzer.\n\nA warning contains an optional source position, a risk level, and a human\nreadable message explaining the finding.\n","args":[],"type":"{ range : Maybe.Maybe DetoXSS.ExprParser.Position, risk : DetoXSS.Ast.Risk, message : String.String }"}],"values":[{"name":"buildRiskTree","comment":" Build a risk-annotated tree from parsed HTML-like nodes.\n\nThe result can be used to visualize which parts of the input contributed to the\noverall risk.\n","type":"DetoXSS.ExprParser.HtmlNode -> DetoXSS.Ast.RiskNode"},{"name":"classifyBalanced","comment":" Classify an input string using the balanced analyzer.\n\nThis combines parsing, AST-based analysis, and additional string-based\nheuristics.\n","type":"String.String -> DetoXSS.Ast.Risk"},{"name":"classifyExpression","comment":" Classify a list of parsed HTML-like nodes.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> DetoXSS.Ast.Risk"},{"name":"classifyExpressionNode","comment":" Classify a single parsed HTML-like node.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> DetoXSS.Ast.Risk"},{"name":"classifyString","comment":" Classify an input string as `Safe`, `Suspicious`, or `Dangerous`.\n\nThis is a high-level helper for string-based classification.\n","type":"String.String -> DetoXSS.Ast.Risk"},{"name":"fromStringToNode","comment":" Parse an input string into HTML-like nodes.\n\nThis function is tolerant and is intended for analysis, not for browser-exact\nHTML parsing.\n","type":"String.String -> Result.Result String.String (List.List DetoXSS.ExprParser.HtmlNode)"},{"name":"renderExpression","comment":" Render parsed HTML-like nodes as a readable text tree.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> List.List DetoXSS.Ast.Warning -> String.String"},{"name":"renderExpressionNode","comment":" Render a single parsed HTML-like node as readable text.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> List.List DetoXSS.Ast.Warning -> String.String"},{"name":"renderRiskTree","comment":" Render a risk-annotated tree as readable text.\n","type":"List.List DetoXSS.Ast.RiskNode -> String.String"},{"name":"scanBalanced","comment":" Analyze an input string and return a compact list of warnings.\n\nThis function is suitable for user-facing output because it removes duplicate or\noverly technical warnings.\n","type":"String.String -> List.List DetoXSS.Ast.Warning"},{"name":"scanBalancedVerbose","comment":" Return the full internal warning list for an input string.\n\nThis is useful for debugging and dataset evaluation. For user-facing output,\nprefer `scanBalanced`, which returns a more compact warning list.\n","type":"String.String -> List.List DetoXSS.Ast.Warning"},{"name":"scanExpression","comment":" Analyze a list of parsed HTML-like nodes.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> List.List DetoXSS.Ast.Warning"},{"name":"scanExpressionNode","comment":" Analyze a single parsed HTML-like node.\n","type":"List.List DetoXSS.ExprParser.HtmlNode -> List.List DetoXSS.Ast.Warning"}],"binops":[]},{"name":"DetoXSS.Attributes","comment":" Helpers for validating URL-like attribute values.\n\nThis module is intended for values used in attributes such as `href` or `src`.\nIt checks whether a URL uses an allowed scheme and returns a validated value\nor a safe fallback.\n\nFor custom scheme lists, use the whitelist-aware variants.\n\n@docs safeHref, safeSrc\n\n@docs safeHrefW, safeSrcW\n\n@docs defaultSchemes\n\n","unions":[],"aliases":[],"values":[{"name":"defaultSchemes","comment":" Default URL schemes accepted by `safeHref` and `safeSrc`.\n\nThe list contains common non-script schemes.\n","type":"List.List String.String"},{"name":"safeHref","comment":" Validate a value intended for an `href` attribute.\n\nThe function returns a pair. The first value says whether the URL was accepted.\nThe second value contains a validated URL value or a safe fallback.\n\n    safeHref \"https://example.com\"\n    safeHref \"javascript:alert(1)\"\n\n","type":"String.String -> ( Basics.Bool, DetoXSS.Core.ValidatedInput )"},{"name":"safeHrefW","comment":" Validate a value intended for an `href` attribute using whitelist schemes.\n\nThe allowed schemes are taken from the provided whitelist state.\n","type":"DetoXSS.Whitelist.State -> String.String -> ( Basics.Bool, DetoXSS.Core.ValidatedInput )"},{"name":"safeSrc","comment":" Validate a value intended for a `src` attribute.\n\nThe function returns a pair. The first value says whether the URL was accepted.\nThe second value contains a validated URL value or a safe fallback.\n\n    safeSrc \"https://example.com/image.png\"\n    safeSrc \"javascript:alert(1)\"\n\n","type":"String.String -> ( Basics.Bool, DetoXSS.Core.ValidatedInput )"},{"name":"safeSrcW","comment":" Validate a value intended for a `src` attribute using whitelist schemes.\n\nThe allowed schemes are taken from the provided whitelist state.\n","type":"DetoXSS.Whitelist.State -> String.String -> ( Basics.Bool, DetoXSS.Core.ValidatedInput )"}],"binops":[]},{"name":"DetoXSS.Core","comment":" Shared types and helpers used by the DetoXSS package.\n\nThis module defines lightweight wrappers for raw, validated, and sanitized\ncontent. The wrappers make the intended state of a value visible in type\nsignatures.\n\nThe module also provides convenience aliases and helpers for whitelist state\nmanagement.\n\n@docs SafeContent, SafeHtml, ValidatedInput, RawInput\n\n@docs Sanitized, Validated, Raw\n\n@docs fromRaw, fromValidated, fromSanitized\n\n@docs getContent\n\n@docs WhitelistState\n\n@docs defaultWhitelist, initWhitelist\n\n@docs enableWhitelist, disableWhitelist, setWhitelist\n\n@docs isWhitelistEnabled, isTagAllowed, isAttrAllowed\n\n","unions":[{"name":"Raw","comment":" Phantom marker for raw content.\n\nRaw content should be treated as untrusted until it is validated, sanitized, or\notherwise processed according to its output context.\n","args":[],"cases":[]},{"name":"SafeContent","comment":" A string wrapped with a phantom state.\n\nThe `state` parameter is used to distinguish raw, validated, and sanitized\nvalues at the type level.\n","args":["state"],"cases":[]},{"name":"Sanitized","comment":" Phantom marker for sanitized content.\n\nValues marked with this state are intended to represent content that has already\ngone through a sanitization step.\n","args":[],"cases":[]},{"name":"Validated","comment":" Phantom marker for validated content.\n\nValues marked with this state are intended to represent content that has passed\na validation step.\n","args":[],"cases":[]}],"aliases":[{"name":"RawInput","comment":" Raw input value.\n\nThis alias is used for values that have not yet been validated or sanitized.\n","args":[],"type":"DetoXSS.Core.SafeContent DetoXSS.Core.Raw"},{"name":"SafeHtml","comment":" Sanitized HTML-like content.\n\nThis alias is used for values that are intended to be safe to pass through the\nDetoXSS API after sanitization.\n","args":[],"type":"DetoXSS.Core.SafeContent DetoXSS.Core.Sanitized"},{"name":"ValidatedInput","comment":" Validated input value.\n\nThis alias is used for values that passed validation rules, for example form\ninput validation.\n","args":[],"type":"DetoXSS.Core.SafeContent DetoXSS.Core.Validated"},{"name":"WhitelistState","comment":" Alias for the whitelist runtime state.\n","args":[],"type":"DetoXSS.Whitelist.State"}],"values":[{"name":"defaultWhitelist","comment":" Default whitelist configuration.\n","type":"DetoXSS.Whitelist.Whitelist"},{"name":"disableWhitelist","comment":" Disable whitelist mode.\n","type":"DetoXSS.Core.WhitelistState -> DetoXSS.Core.WhitelistState"},{"name":"enableWhitelist","comment":" Enable whitelist mode.\n","type":"DetoXSS.Core.WhitelistState -> DetoXSS.Core.WhitelistState"},{"name":"fromRaw","comment":" Wrap a string as raw input.\n\nThis function does not validate or sanitize the value. It only marks the value\nas raw at the type level.\n","type":"String.String -> DetoXSS.Core.RawInput"},{"name":"fromSanitized","comment":" Wrap a string as sanitized content.\n\nThis function does not sanitize the value by itself. It should be used only\nafter the caller has already sanitized the value.\n\nFor actual sanitization, use functions from `DetoXSS.Sanitize`.\n","type":"String.String -> DetoXSS.Core.SafeHtml"},{"name":"fromValidated","comment":" Wrap a string as validated input.\n\nThis function does not perform validation by itself. It should be used only\nafter the caller has already validated the value.\n","type":"String.String -> DetoXSS.Core.ValidatedInput"},{"name":"getContent","comment":" Extract the underlying string from a wrapped value.\n","type":"DetoXSS.Core.SafeContent state -> String.String"},{"name":"initWhitelist","comment":" Initial whitelist state.\n\nThe default whitelist configuration is loaded, but whitelist mode is disabled.\n","type":"DetoXSS.Core.WhitelistState"},{"name":"isAttrAllowed","comment":" Check whether an attribute is allowed by the whitelist state.\n","type":"DetoXSS.Core.WhitelistState -> String.String -> Basics.Bool"},{"name":"isTagAllowed","comment":" Check whether a tag is allowed by the whitelist state.\n","type":"DetoXSS.Core.WhitelistState -> String.String -> Basics.Bool"},{"name":"isWhitelistEnabled","comment":" Check whether whitelist mode is enabled.\n","type":"DetoXSS.Core.WhitelistState -> Basics.Bool"},{"name":"setWhitelist","comment":" Replace the whitelist configuration.\n","type":"DetoXSS.Whitelist.Whitelist -> DetoXSS.Core.WhitelistState -> DetoXSS.Core.WhitelistState"}],"binops":[]},{"name":"DetoXSS.ExprParser","comment":" Tolerant parser for HTML-like input.\n\nThis module converts an input string into a lightweight tree representation used\nby the AST analyzer. It is intentionally tolerant because security-related input\ncan be malformed, incomplete, or intentionally obfuscated.\n\nMost users should use the higher-level functions in `DetoXSS.Ast` instead of\ncalling this parser directly.\n\n@docs parseExpression\n\n@docs Parsed, HtmlNode, HtmlAttribute, Position\n\n","unions":[{"name":"HtmlNode","comment":" Lightweight HTML-like node representation.\n\nThe parser distinguishes element nodes, text nodes, and comments. Element nodes\ncontain a tag name, attributes, child nodes, and source position.\n","args":[],"cases":[["Element",["{ tag : String.String, attributes : List.List DetoXSS.ExprParser.HtmlAttribute, children : List.List DetoXSS.ExprParser.HtmlNode, position : DetoXSS.ExprParser.Position }"]],["Text",["{ content : String.String, position : DetoXSS.ExprParser.Position }"]],["Comment",["{ content : String.String, position : DetoXSS.ExprParser.Position }"]]]},{"name":"Parsed","comment":" Result of parsing an HTML-like input.\n\n`Ok` contains parsed HTML-like nodes. `Err` contains a parser error message.\n\nThis type is intentionally small because the parser is used as an internal\nanalysis step for XSS detection.\n","args":[],"cases":[["Ok",["List.List DetoXSS.ExprParser.HtmlNode"]],["Err",["String.String"]]]}],"aliases":[{"name":"HtmlAttribute","comment":" HTML-like attribute representation.\n\nEach attribute contains its normalized name, parsed value, and source position.\nBoolean attributes are represented with an empty string as their value.\n","args":[],"type":"{ name : String.String, value : String.String, position : DetoXSS.ExprParser.Position }"},{"name":"Position","comment":" Source position in the parsed input.\n\nThe position stores row and column numbers reported by the Elm parser.\n","args":[],"type":"{ row : Basics.Int, col : Basics.Int }"}],"values":[{"name":"parseExpression","comment":" Parse an HTML-like string into a list of lightweight nodes.\n\nThe parser is tolerant and is intended for security analysis rather than\nbrowser-exact HTML parsing.\n\n    parseExpression \"<p>Hello</p>\"\n\n","type":"String.String -> DetoXSS.ExprParser.Parsed"}],"binops":[]},{"name":"DetoXSS.Port","comment":" JSON decoders and encoders for values crossing Elm ports.\n\nPorts are a trust boundary between Elm and JavaScript. Values received through\nports should be treated as untrusted. This module provides capped decoders for\nHTML-like values, attribute values, URL values, and lists of sanitized HTML\nvalues.\n\nThe analyzed decoders combine port decoding with `DetoXSS.Ast` classification\nand an application-level analysis policy.\n\n@docs Inbound, UrlResult, AnalysisPolicy, HtmlResult\n\n@docs inboundDecoder, inboundDecoderAnalyzed\n\n@docs rawDecoderCapped, validatedAttrDecoder\n\n@docs safeHtmlDecoderW, safeHtmlDecoderAnalyzedW, safeHtmlResultDecoderW\n\n@docs safeHtmlListDecoderW, safeHtmlListDecoderAnalyzedW\n\n@docs urlDecoderW\n\n@docs analyzeRawHtml\n\n@docs encodeRisk, encodeHtmlResult\n\n@docs encodeSafeHtml, encodeSafeHtmlList\n\n@docs encodeValidated, encodeValidatedList\n\n@docs encodeUrlResult\n\n@docs maxChars, maxListLen\n\n@docs normalizeNewlines, stripControl\n\n","unions":[{"name":"AnalysisPolicy","comment":" Policy used by analyzed port decoders.\n\n`AllowAfterSanitize` always allows the value after sanitization.\n`RejectDangerous` rejects values classified as `Dangerous`.\n`RejectSuspiciousAndDangerous` rejects values classified as `Suspicious` or\n`Dangerous`.\n","args":[],"cases":[["AllowAfterSanitize",[]],["RejectDangerous",[]],["RejectSuspiciousAndDangerous",[]]]},{"name":"Inbound","comment":" Values that can be received through the generic inbound port decoder.\n\nThe constructors distinguish sanitized HTML-like values, validated attribute\nvalues, URL validation results, and lists of sanitized HTML-like values.\n","args":[],"cases":[["InHtml",["DetoXSS.Core.SafeHtml"]],["InAttr",["DetoXSS.Core.ValidatedInput"]],["InUrl",["DetoXSS.Port.UrlResult"]],["InHtmlList",["List.List DetoXSS.Core.SafeHtml"]]]}],"aliases":[{"name":"HtmlResult","comment":" Result of analyzing and sanitizing an HTML-like value.\n\nThe record contains whether the value was accepted, the AST risk level, the\nsanitized value, and a human-readable reason.\n","args":[],"type":"{ ok : Basics.Bool, risk : DetoXSS.Ast.Risk, value : DetoXSS.Core.SafeHtml, reason : String.String }"},{"name":"UrlResult","comment":" Result of validating a URL-like value from a port.\n\n`ok` says whether the value was accepted. `value` contains either the accepted\nURL or a safe fallback.\n","args":[],"type":"{ ok : Basics.Bool, value : DetoXSS.Core.ValidatedInput }"}],"values":[{"name":"analyzeRawHtml","comment":" Analyze and sanitize a raw HTML-like string.\n\nThis helper is useful when an application already has a raw string and wants to\napply the same AST policy and whitelist sanitization logic used by the analyzed\nport decoders.\n","type":"String.String -> DetoXSS.Ast.Risk"},{"name":"encodeHtmlResult","comment":" Encode an `HtmlResult` as JSON.\n\nThis is useful for sending analysis results back to JavaScript through an\noutbound port.\n","type":"DetoXSS.Port.HtmlResult -> Json.Encode.Value"},{"name":"encodeRisk","comment":" Encode an AST risk value as a JSON string.\n\nThe output is one of `\"safe\"`, `\"suspicious\"`, or `\"dangerous\"`.\n","type":"DetoXSS.Ast.Risk -> Json.Encode.Value"},{"name":"encodeSafeHtml","comment":" Encode sanitized HTML-like content for an outbound port.\n","type":"DetoXSS.Core.SafeHtml -> Json.Encode.Value"},{"name":"encodeSafeHtmlList","comment":" Encode a list of sanitized HTML-like values for an outbound port.\n","type":"List.List DetoXSS.Core.SafeHtml -> Json.Encode.Value"},{"name":"encodeUrlResult","comment":" Encode a URL validation result for an outbound port.\n","type":"DetoXSS.Port.UrlResult -> Json.Encode.Value"},{"name":"encodeValidated","comment":" Encode validated input for an outbound port.\n","type":"DetoXSS.Core.ValidatedInput -> Json.Encode.Value"},{"name":"encodeValidatedList","comment":" Encode a list of validated input values for an outbound port.\n","type":"List.List DetoXSS.Core.ValidatedInput -> Json.Encode.Value"},{"name":"inboundDecoder","comment":" Decode an inbound JSON value from a port.\n\nThe decoder expects an object with a `type` field and a `value` field. The\n`type` field decides whether the value is treated as HTML-like content,\nattribute content, URL content, or a list of HTML-like values.\n","type":"DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Port.Inbound"},{"name":"inboundDecoderAnalyzed","comment":" Decode inbound port data and apply AST analysis for HTML-like values.\n\nThe provided policy controls whether suspicious or dangerous values are accepted\nor rejected. Non-HTML values are decoded using the same rules as\n`inboundDecoder`.\n","type":"DetoXSS.Port.AnalysisPolicy -> DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Port.Inbound"},{"name":"maxChars","comment":" Maximum number of characters accepted by capped port decoders.\n","type":"Basics.Int"},{"name":"maxListLen","comment":" Maximum number of items accepted by list decoders.\n","type":"Basics.Int"},{"name":"normalizeNewlines","comment":" Normalize newline characters.\n\nThis converts Windows and old Mac line endings to `\\n`.\n","type":"String.String -> String.String"},{"name":"rawDecoderCapped","comment":" Decode a raw string with length limiting.\n\nThe decoder fails if the value exceeds `maxChars`.\n","type":"Json.Decode.Decoder DetoXSS.Core.RawInput"},{"name":"safeHtmlDecoderAnalyzedW","comment":" Decode a single HTML-like string with whitelist sanitization and AST policy.\n\nIf the policy rejects the detected risk level, decoding fails.\n","type":"DetoXSS.Port.AnalysisPolicy -> DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Core.SafeHtml"},{"name":"safeHtmlDecoderW","comment":" Decode an HTML-like string and sanitize it with a whitelist state.\n","type":"DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Core.SafeHtml"},{"name":"safeHtmlListDecoderAnalyzedW","comment":" Decode a list of HTML-like strings with whitelist sanitization and AST policy.\n\nIf any item is rejected by the policy, the whole decoder fails.\n","type":"DetoXSS.Port.AnalysisPolicy -> DetoXSS.Whitelist.State -> Json.Decode.Decoder (List.List DetoXSS.Core.SafeHtml)"},{"name":"safeHtmlListDecoderW","comment":" Decode a list of HTML-like strings and sanitize every item.\n\nThe decoder fails if the list exceeds `maxListLen`.\n","type":"DetoXSS.Whitelist.State -> Json.Decode.Decoder (List.List DetoXSS.Core.SafeHtml)"},{"name":"safeHtmlResultDecoderW","comment":" Decode a single HTML-like string and return an analysis result.\n\nUnlike `safeHtmlDecoderAnalyzedW`, this decoder returns a structured\n`HtmlResult` containing the risk and rejection reason instead of only returning\nthe sanitized value.\n","type":"DetoXSS.Port.AnalysisPolicy -> DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Port.HtmlResult"},{"name":"stripControl","comment":" Remove control characters from a string.\n\nNewline, carriage return, and tab characters are preserved.\n","type":"String.String -> String.String"},{"name":"urlDecoderW","comment":" Decode a URL-like string and validate it with whitelist URL schemes.\n","type":"DetoXSS.Whitelist.State -> Json.Decode.Decoder DetoXSS.Port.UrlResult"},{"name":"validatedAttrDecoder","comment":" Decode an attribute-like string and wrap it as validated input.\n","type":"Json.Decode.Decoder DetoXSS.Core.ValidatedInput"}],"binops":[]},{"name":"DetoXSS.Sanitize","comment":" Sanitization helpers for plain text, attributes, and limited HTML.\n\nUse `sanitizeText` when the whole input should be displayed as text.\nUse `sanitizeWithWhitelist` when a small set of HTML tags and attributes should\nbe preserved according to a whitelist configuration.\n\nThe sanitizer is designed as a practical safety layer. It should be used\ntogether with context-aware output handling and, when needed, with the AST\nanalyzer from `DetoXSS.Ast`.\n\n@docs sanitizeText, sanitizeWithWhitelist\n\n@docs sanitizeForAttribute\n\n@docs encodeHtml, decodeBasicEntities, stripControl\n\n","unions":[],"aliases":[],"values":[{"name":"decodeBasicEntities","comment":" Decode a small set of common HTML entities.\n\nThis helper is used before sanitization so that already encoded input can be\nnormalized before being escaped again.\n","type":"String.String -> String.String"},{"name":"encodeHtml","comment":" Escape HTML-sensitive characters.\n\nThis converts characters such as `<`, `>`, `&`, `\"`, and `'` into HTML\nentities so that the value can be displayed as text instead of being interpreted\nas markup.\n","type":"String.String -> String.String"},{"name":"sanitizeForAttribute","comment":" Sanitize a value intended for an attribute-like context.\n\nThis removes control characters, collapses whitespace, and wraps the result as\nvalidated input. It does not make arbitrary attribute usage safe in every\npossible context.\n","type":"String.String -> DetoXSS.Core.ValidatedInput"},{"name":"sanitizeText","comment":" Sanitize input that should be displayed as plain text.\n\nThe whole input is treated as text. HTML tags are not preserved.\n\n    sanitizeText \"<script>alert(1)</script>\"\n\n","type":"String.String -> DetoXSS.Core.SafeHtml"},{"name":"sanitizeWithWhitelist","comment":" Sanitize HTML-like input using a whitelist state.\n\nWhen whitelist mode is enabled, only allowed tags and attributes are preserved.\nWhen whitelist mode is disabled, the whole input is escaped as text.\n\n    sanitizeWithWhitelist whitelistState \"<p>Hello</p>\"\n\n","type":"DetoXSS.Whitelist.State -> String.String -> DetoXSS.Core.SafeHtml"},{"name":"stripControl","comment":" Remove control characters from a string.\n\nNewline, carriage return, and tab characters are preserved.\n","type":"String.String -> String.String"}],"binops":[]},{"name":"DetoXSS.Validate","comment":" General validation helpers for form input.\n\nThis module validates whether a value follows application-level rules such as\nbeing non-empty, having a specific length, matching a regular expression, or\nlooking like an email address.\n\nValidation is not the same as XSS protection. A valid value may still need\nsanitization or AST analysis before it is used in an output context.\n\n@docs ValidationError, Rule\n\n@docs validate\n\n@docs validateEmail, validatePhone, validateUsername, validatePassword\n\n@docs nonEmpty, minLength, maxLength\n\n@docs allowedChars, matchesRegex\n\n","unions":[{"name":"ValidationError","comment":" Possible validation errors returned by the validation helpers.\n\nThese errors describe why a value did not pass a validation rule.\n","args":[],"cases":[["Empty",[]],["TooShort",["Basics.Int"]],["TooLong",["Basics.Int"]],["InvalidEmail",[]],["InvalidPhone",[]],["InvalidChars",["String.String"]],["WeakPassword",["String.String"]],["Custom",["String.String"]]]}],"aliases":[{"name":"Rule","comment":" Validation rule.\n\nA rule receives a string and returns a list of validation errors. An empty list\nmeans that the value passed that rule.\n","args":[],"type":"String.String -> List.List DetoXSS.Validate.ValidationError"}],"values":[{"name":"allowedChars","comment":" Require the value to match a regular expression.\n\nThe description is used in the `InvalidChars` error when the value does not\nmatch.\n","type":"Regex.Regex -> String.String -> DetoXSS.Validate.Rule"},{"name":"matchesRegex","comment":" Create a validation rule from a regular expression and custom error.\n","type":"Regex.Regex -> DetoXSS.Validate.ValidationError -> DetoXSS.Validate.Rule"},{"name":"maxLength","comment":" Require a maximum string length.\n","type":"Basics.Int -> String.String -> List.List DetoXSS.Validate.ValidationError"},{"name":"minLength","comment":" Require a minimum string length.\n","type":"Basics.Int -> String.String -> List.List DetoXSS.Validate.ValidationError"},{"name":"nonEmpty","comment":" Require a non-empty value.\n","type":"String.String -> List.List DetoXSS.Validate.ValidationError"},{"name":"validate","comment":" Run a list of validation rules against a string.\n\nThe input is trimmed before validation. If all rules pass, the cleaned value is\nreturned as `ValidatedInput`.\n","type":"List.List DetoXSS.Validate.Rule -> String.String -> Result.Result (List.List DetoXSS.Validate.ValidationError) DetoXSS.Core.ValidatedInput"},{"name":"validateEmail","comment":" Validate a simple email address.\n\nThis checks the general shape of an email address. It does not verify whether\nthe address actually exists.\n","type":"String.String -> Result.Result (List.List DetoXSS.Validate.ValidationError) DetoXSS.Core.ValidatedInput"},{"name":"validatePassword","comment":" Validate a password.\n\nThe password must be non-empty, have a minimum length, and contain a mixture of\ncharacter classes.\n","type":"String.String -> Result.Result (List.List DetoXSS.Validate.ValidationError) DetoXSS.Core.ValidatedInput"},{"name":"validatePhone","comment":" Validate a phone-like value.\n\nThe value may contain digits, spaces, plus signs, dashes, and parentheses.\n","type":"String.String -> Result.Result (List.List DetoXSS.Validate.ValidationError) DetoXSS.Core.ValidatedInput"},{"name":"validateUsername","comment":" Validate a username.\n\nThe username must be non-empty, have an allowed length, and contain only\nletters, digits, underscores, dots, or dashes.\n","type":"String.String -> Result.Result (List.List DetoXSS.Validate.ValidationError) DetoXSS.Core.ValidatedInput"}],"binops":[]},{"name":"DetoXSS.Whitelist","comment":" Whitelist configuration for controlled HTML sanitization.\n\nA whitelist defines which tags, attributes, URL attributes, and URL schemes may\nbe preserved by `DetoXSS.Sanitize.sanitizeWithWhitelist`.\n\nThe whitelist is intended for allowing a small, explicit set of safe formatting\nfeatures. It is not meant to allow arbitrary active HTML content. Some dangerous\ntags, attributes, and schemes are blocked regardless of the custom whitelist.\n\n@docs State, Whitelist\n\n@docs defaultConfig, initialState\n\n@docs enable, disable, isEnabled\n\n@docs set, get\n\n@docs fromLists, fromAll, fromAllFull\n\n@docs isAllowedTag, isAllowedAttribute, isUrlAttribute\n\n@docs getAll, getAllFull, getAllowedSchemes\n\n@docs setAttributes, setUrlAttributes, setSchemes\n\n@docs blockedTags, blockedAttributes, blockedSchemes\n\n@docs isBlockedTag, isBlockedAttribute, isBlockedScheme\n\n","unions":[],"aliases":[{"name":"State","comment":" Runtime state of whitelist sanitization.\n\nThe `active` field controls whether whitelist mode is enabled. When whitelist\nmode is disabled, sanitization treats the whole input as text instead of\npreserving HTML tags.\n","args":[],"type":"{ active : Basics.Bool, config : DetoXSS.Whitelist.Whitelist }"},{"name":"Whitelist","comment":" Whitelist configuration used by `sanitizeWithWhitelist`.\n\nThe configuration contains four lists:\n\n  - `tags` are HTML tag names that may be preserved.\n  - `attributes` are attribute names that may be preserved.\n  - `urlAttributes` are attributes whose values should be treated as URLs.\n  - `allowedSchemes` are URL schemes accepted in URL-like attributes.\n\nThe configuration is normalized when it is created through helper functions such\nas `fromLists`, `fromAll`, or `fromAllFull`.\n","args":[],"type":"{ tags : List.List String.String, attributes : List.List String.String, urlAttributes : List.List String.String, allowedSchemes : List.List String.String }"}],"values":[{"name":"blockedAttributes","comment":" Attributes that are blocked regardless of whitelist configuration.\n\nThis includes style-related and document-embedding attributes. Inline event\nhandler attributes such as `onclick` and `onerror` are also blocked by\n`isBlockedAttribute`.\n","type":"List.List String.String"},{"name":"blockedSchemes","comment":" URL schemes that are blocked regardless of whitelist configuration.\n","type":"List.List String.String"},{"name":"blockedTags","comment":" Tags that are blocked regardless of whitelist configuration.\n\nThese tags are considered too risky to preserve in sanitized HTML.\n","type":"List.List String.String"},{"name":"defaultConfig","comment":" Default whitelist configuration.\n\nIt allows a small set of common formatting tags, link and image attributes, and\ncommon URL schemes such as `http:`, `https:`, `mailto:`, and `tel:`.\n","type":"DetoXSS.Whitelist.Whitelist"},{"name":"disable","comment":" Disable whitelist-based sanitization.\n\nWhen disabled, `sanitizeWithWhitelist` treats the whole input as text.\n","type":"DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"},{"name":"enable","comment":" Enable whitelist-based sanitization.\n\nWhen enabled, `sanitizeWithWhitelist` may preserve allowed tags and attributes.\n","type":"DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"},{"name":"fromAll","comment":" Create a whitelist from allowed tags, attributes, and URL schemes.\n\nThe URL-like attributes default to `href` and `src`.\n\n    fromAll\n        [ \"p\", \"a\" ]\n        [ \"href\" ]\n        [ \"http:\", \"https:\" ]\n\n","type":"List.List String.String -> List.List String.String -> List.List String.String -> DetoXSS.Whitelist.Whitelist"},{"name":"fromAllFull","comment":" Create a full whitelist configuration.\n\nThis variant allows configuring allowed tags, allowed attributes, URL-like\nattributes, and allowed URL schemes explicitly.\n\n    fromAllFull\n        [ \"p\", \"a\", \"img\" ]\n        [ \"href\", \"src\", \"alt\" ]\n        [ \"href\", \"src\" ]\n        [ \"http:\", \"https:\" ]\n\n","type":"List.List String.String -> List.List String.String -> List.List String.String -> List.List String.String -> DetoXSS.Whitelist.Whitelist"},{"name":"fromLists","comment":" Create a whitelist from allowed tags and attributes.\n\nThe URL-like attributes default to `href` and `src`. The allowed URL schemes\ndefault to `defaultConfig.allowedSchemes`.\n\n    fromLists [ \"p\", \"strong\", \"a\" ] [ \"href\", \"title\" ]\n\n","type":"List.List String.String -> List.List String.String -> DetoXSS.Whitelist.Whitelist"},{"name":"get","comment":" Get allowed tags and attributes from the current state.\n","type":"DetoXSS.Whitelist.State -> { tags : List.List String.String, attributes : List.List String.String }"},{"name":"getAll","comment":" Get allowed tags, attributes, and URL schemes from the current state.\n","type":"DetoXSS.Whitelist.State -> { tags : List.List String.String, attributes : List.List String.String, schemes : List.List String.String }"},{"name":"getAllFull","comment":" Get the full whitelist configuration from the current state.\n\nThis includes allowed tags, allowed attributes, URL-like attributes, and allowed\nURL schemes.\n","type":"DetoXSS.Whitelist.State -> { tags : List.List String.String, attributes : List.List String.String, urlAttributes : List.List String.String, schemes : List.List String.String }"},{"name":"getAllowedSchemes","comment":" Get allowed URL schemes.\n\nIf whitelist mode is disabled, the default scheme list is returned.\n","type":"DetoXSS.Whitelist.State -> List.List String.String"},{"name":"initialState","comment":" Initial whitelist state.\n\nThe default configuration is loaded, but whitelist mode is disabled.\n\nUse `enable` to activate whitelist-based sanitization.\n","type":"DetoXSS.Whitelist.State"},{"name":"isAllowedAttribute","comment":" Check whether an attribute is allowed by the current whitelist configuration.\n","type":"DetoXSS.Whitelist.State -> String.String -> Basics.Bool"},{"name":"isAllowedTag","comment":" Check whether a tag is allowed by the current whitelist configuration.\n","type":"DetoXSS.Whitelist.State -> String.String -> Basics.Bool"},{"name":"isBlockedAttribute","comment":" Check whether an attribute is hard-blocked.\n\nThis returns `True` for inline event handlers such as `onclick`, for attributes\nlisted in `blockedAttributes`, and for namespace declarations starting with\n`xmlns`.\n","type":"String.String -> Basics.Bool"},{"name":"isBlockedScheme","comment":" Check whether a URL scheme is hard-blocked.\n","type":"String.String -> Basics.Bool"},{"name":"isBlockedTag","comment":" Check whether a tag is hard-blocked.\n","type":"String.String -> Basics.Bool"},{"name":"isEnabled","comment":" Check whether whitelist mode is enabled.\n","type":"DetoXSS.Whitelist.State -> Basics.Bool"},{"name":"isUrlAttribute","comment":" Check whether an attribute should be treated as URL-like.\n\nURL-like attributes are validated against the allowed URL schemes during\nsanitization.\n","type":"DetoXSS.Whitelist.State -> String.String -> Basics.Bool"},{"name":"set","comment":" Replace the current whitelist configuration.\n\nThe configuration is normalized before being stored. Blocked tags, blocked\nattributes, and blocked schemes are removed during normalization.\n","type":"DetoXSS.Whitelist.Whitelist -> DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"},{"name":"setAttributes","comment":" Replace the allowed attributes in the current whitelist state.\n","type":"List.List String.String -> DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"},{"name":"setSchemes","comment":" Replace the allowed URL schemes in the current whitelist state.\n\nSchemes are normalized to lowercase and always end with `:`.\n","type":"List.List String.String -> DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"},{"name":"setUrlAttributes","comment":" Replace the URL-like attributes in the current whitelist state.\n\nURL-like attributes are checked against allowed URL schemes during\nsanitization.\n","type":"List.List String.String -> DetoXSS.Whitelist.State -> DetoXSS.Whitelist.State"}],"binops":[]}]