dominikmifkovic/detoxss/1.0.0

Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/dominikmifkovic/detoxss is gone (deleted or private); Software Heritage has not archived the repo; no fork with the same repo name found; no cached copy. Use another version.

Details

DetoXSS.Attributes

Helpers for validating URL-like attribute values.

This module is intended for values used in attributes such as href or src. It checks whether a URL uses an allowed scheme and returns a validated value or a safe fallback.

For custom scheme lists, use the whitelist-aware variants.

safeHref : String -> ( Bool, ValidatedInput )

Validate a value intended for an href attribute.

The function returns a pair. The first value says whether the URL was accepted. The second value contains a validated URL value or a safe fallback.

safeHref "https://example.com"
safeHref "javascript:alert(1)"
safeSrc : String -> ( Bool, ValidatedInput )

Validate a value intended for a src attribute.

The function returns a pair. The first value says whether the URL was accepted. The second value contains a validated URL value or a safe fallback.

safeSrc "https://example.com/image.png"
safeSrc "javascript:alert(1)"
safeHrefW : State -> String -> ( Bool, ValidatedInput )

Validate a value intended for an href attribute using whitelist schemes.

The allowed schemes are taken from the provided whitelist state.

safeSrcW : State -> String -> ( Bool, ValidatedInput )

Validate a value intended for a src attribute using whitelist schemes.

The allowed schemes are taken from the provided whitelist state.

defaultSchemes : List String

Default URL schemes accepted by safeHref and safeSrc.

The list contains common non-script schemes.