Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/dominikmifkovic/detoxss is gone (deleted or private); Software Heritage has not archived the repo; no fork with the same repo name found; no cached copy. Use another version.

README About Versions Source Modules

DetoXSS.Ast

Static XSS-oriented analysis for HTML-like strings.

This module provides the main detection layer of the package. It classifies input as Safe, Suspicious, or Dangerous, and can also return warnings explaining why a value was considered risky.

The analyzer is intended for detection and decision making. It does not rewrite or sanitize the input by itself. For output sanitization, use DetoXSS.Sanitize.

type Risk

= Safe

| Suspicious

| Dangerous

Risk classification returned by the analyzer.

Safe means that no known risky pattern was found. Suspicious means that the input contains potentially risky patterns. Dangerous means that a clear XSS indicator was detected.

type alias Warning =

{ range : Maybe Position

, risk : Risk

, message : String

}

Warning produced by the analyzer.

A warning contains an optional source position, a risk level, and a human readable message explaining the finding.

= RiskNode

{ node : HtmlNode

, selfWarnings : List Warning

, aggregateRisk : Risk

, children : List RiskNode

}

Tree node annotated with XSS-related risk information.

selfWarnings describe findings directly related to the current node. aggregateRisk also takes child nodes into account.

classifyString : String -> Risk

Classify an input string as Safe, Suspicious, or Dangerous.

This is a high-level helper for string-based classification.

classifyBalanced : String -> Risk

Classify an input string using the balanced analyzer.

This combines parsing, AST-based analysis, and additional string-based heuristics.

classifyExpression : List HtmlNode -> Risk

Classify a list of parsed HTML-like nodes.

classifyExpressionNode : List HtmlNode -> Risk

Classify a single parsed HTML-like node.

scanBalanced : String -> List Warning

Analyze an input string and return a compact list of warnings.

This function is suitable for user-facing output because it removes duplicate or overly technical warnings.

scanBalancedVerbose : String -> List Warning

Return the full internal warning list for an input string.

This is useful for debugging and dataset evaluation. For user-facing output, prefer scanBalanced, which returns a more compact warning list.

scanExpression : List HtmlNode -> List Warning

Analyze a list of parsed HTML-like nodes.

scanExpressionNode : List HtmlNode -> List Warning

Analyze a single parsed HTML-like node.

buildRiskTree : HtmlNode -> RiskNode

Build a risk-annotated tree from parsed HTML-like nodes.

The result can be used to visualize which parts of the input contributed to the overall risk.

renderRiskTree : List RiskNode -> String

Render a risk-annotated tree as readable text.

renderExpression : List HtmlNode -> List Warning -> String

Render parsed HTML-like nodes as a readable text tree.

renderExpressionNode : List HtmlNode -> List Warning -> String

Render a single parsed HTML-like node as readable text.

fromStringToNode : String -> Result String (List HtmlNode)

Parse an input string into HTML-like nodes.

This function is tolerant and is intended for analysis, not for browser-exact HTML parsing.

Modules