Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/dominikmifkovic/detoxss is gone (deleted or private); Software Heritage has not archived the repo; no fork with the same repo name found; no cached copy. Use another version.
JSON decoders and encoders for values crossing Elm ports.
Ports are a trust boundary between Elm and JavaScript. Values received through ports should be treated as untrusted. This module provides capped decoders for HTML-like values, attribute values, URL values, and lists of sanitized HTML values.
The analyzed decoders combine port decoding with DetoXSS.Ast classification
and an application-level analysis policy.
Result of validating a URL-like value from a port.
ok says whether the value was accepted. value contains either the accepted
URL or a safe fallback.
Policy used by analyzed port decoders.
AllowAfterSanitize always allows the value after sanitization.
RejectDangerous rejects values classified as Dangerous.
RejectSuspiciousAndDangerous rejects values classified as Suspicious or
Dangerous.
Result of analyzing and sanitizing an HTML-like value.
The record contains whether the value was accepted, the AST risk level, the sanitized value, and a human-readable reason.
Decode an inbound JSON value from a port.
The decoder expects an object with a type field and a value field. The
type field decides whether the value is treated as HTML-like content,
attribute content, URL content, or a list of HTML-like values.
Decode inbound port data and apply AST analysis for HTML-like values.
The provided policy controls whether suspicious or dangerous values are accepted
or rejected. Non-HTML values are decoded using the same rules as
inboundDecoder.
Decode a raw string with length limiting.
The decoder fails if the value exceeds maxChars.
Decode an attribute-like string and wrap it as validated input.
Decode an HTML-like string and sanitize it with a whitelist state.
Decode a single HTML-like string with whitelist sanitization and AST policy.
If the policy rejects the detected risk level, decoding fails.
Decode a single HTML-like string and return an analysis result.
Unlike safeHtmlDecoderAnalyzedW, this decoder returns a structured
HtmlResult containing the risk and rejection reason instead of only returning
the sanitized value.
Decode a list of HTML-like strings and sanitize every item.
The decoder fails if the list exceeds maxListLen.
Decode a list of HTML-like strings with whitelist sanitization and AST policy.
If any item is rejected by the policy, the whole decoder fails.
Decode a URL-like string and validate it with whitelist URL schemes.
Analyze and sanitize a raw HTML-like string.
This helper is useful when an application already has a raw string and wants to apply the same AST policy and whitelist sanitization logic used by the analyzed port decoders.
Encode an AST risk value as a JSON string.
The output is one of "safe", "suspicious", or "dangerous".
Encode an HtmlResult as JSON.
This is useful for sending analysis results back to JavaScript through an outbound port.
Encode sanitized HTML-like content for an outbound port.
Encode a list of sanitized HTML-like values for an outbound port.
Encode validated input for an outbound port.
Encode a list of validated input values for an outbound port.
Encode a URL validation result for an outbound port.
Maximum number of characters accepted by capped port decoders.
Maximum number of items accepted by list decoders.
Normalize newline characters.
This converts Windows and old Mac line endings to \n.
Remove control characters from a string.
Newline, carriage return, and tab characters are preserved.
Values that can be received through the generic inbound port decoder.
The constructors distinguish sanitized HTML-like values, validated attribute values, URL validation results, and lists of sanitized HTML-like values.