DetoXSS.Sanitize

Sanitization helpers for plain text, attributes, and limited HTML.

Use sanitizeText when the whole input should be displayed as text. Use sanitizeWithWhitelist when a small set of HTML tags and attributes should be preserved according to a whitelist configuration.

The sanitizer is designed as a practical safety layer. It should be used together with context-aware output handling and, when needed, with the AST analyzer from DetoXSS.Ast.

sanitizeText : String -> SafeHtml

Sanitize input that should be displayed as plain text.

The whole input is treated as text. HTML tags are not preserved.

sanitizeText "<script>alert(1)</script>"

sanitizeWithWhitelist : State -> String -> SafeHtml

Sanitize HTML-like input using a whitelist state.

When whitelist mode is enabled, only allowed tags and attributes are preserved. When whitelist mode is disabled, the whole input is escaped as text.

sanitizeWithWhitelist whitelistState "<p>Hello</p>"

sanitizeForAttribute : String -> ValidatedInput

Sanitize a value intended for an attribute-like context.

This removes control characters, collapses whitespace, and wraps the result as validated input. It does not make arbitrary attribute usage safe in every possible context.

encodeHtml : String -> String

Escape HTML-sensitive characters.

This converts characters such as <, >, &, ", and ' into HTML entities so that the value can be displayed as text instead of being interpreted as markup.

decodeBasicEntities : String -> String

Decode a small set of common HTML entities.

This helper is used before sanitization so that already encoded input can be normalized before being escaped again.

stripControl : String -> String

Remove control characters from a string.

Newline, carriage return, and tab characters are preserved.

dominikmifkovic/detoxss/1.0.0

DetoXSS.Sanitize

Modules