Symfony HTML Sanitizer

https://github.com/symfony/html-sanitizer
Admin
Symfony HTML Sanitizer provides an object-oriented API to sanitize untrusted HTML input for safe...
Tokens:33,445
Snippets:448
Trust Score:9.5
License:MIT
Update:2 months ago
Show doc for...
Tokens:
Raw
### getSupportedAttributes Implementation Examples

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Examples showing how to restrict a sanitizer to specific attributes or apply it to all attributes by returning null.

```php
public function getSupportedAttributes(): ?array {
    return ['href', 'src', 'action'];  // Only sanitize these attributes
}

// vs.

public function getSupportedAttributes(): ?array {
    return null;  // Sanitize all attributes
}
```

--------------------------------

### blockElement configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to block specific elements.

```php
$config = (new HtmlSanitizerConfig())
    ->blockElement('section')  // Removes <section> tags but keeps content
    ->blockElement('article');
```

--------------------------------

### dropElement configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to drop specific elements.

```php
$config = (new HtmlSanitizerConfig())
    ->dropElement('script')  // Removes <script> and content
    ->dropElement('iframe')
    ->dropElement('noscript');
```

--------------------------------

### getSupportedElements Implementation Examples

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Examples showing how to restrict a sanitizer to specific elements or apply it to all elements by returning null.

```php
public function getSupportedElements(): ?array {
    return ['a', 'area'];  // Only sanitize these elements
}

// vs.

public function getSupportedElements(): ?array {
    return null;  // Sanitize all elements
}
```

--------------------------------

### allowElement configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to allow specific elements with or without attributes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('div')  // No attributes allowed
    ->allowElement('a', ['href', 'title'])  // Specific attributes
    ->allowElement('span', '*');  // All standard attributes
```

--------------------------------

### Basic initialization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of initializing the HtmlSanitizer with a configuration object.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);
```

--------------------------------

### Usage of allowSafeElements()

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Example of initializing the sanitizer with the safe elements preset.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);
$output = $sanitizer->sanitize($userInput);
```

--------------------------------

### allowAttribute configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to restrict attributes to specific elements.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->allowElement('div', [])
    ->allowElement('span', [])
    ->allowAttribute('title', ['a', 'div']);  // 'title' on a, div; removed from span
    ->allowAttribute('data-x', '*');  // 'data-x' on all allowed elements
```

--------------------------------

### forceAttribute configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to force attribute values on elements.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->forceAttribute('a', 'rel', 'noopener noreferrer')
    ->forceAttribute('a', 'target', '_blank');
```

--------------------------------

### Parsing URLs example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Demonstrates parsing a standard absolute URL into its components.

```php
use Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer;

$url = 'https://user:pass@example.com:8080/path?query=value#fragment';
$parts = UrlSanitizer::parse($url);

// Result:
// [
//     'scheme' => 'https',
//     'user' => 'user',
//     'pass' => 'pass',
//     'host' => 'example.com',
//     'port' => 8080,
//     'path' => '/path',
//     'query' => 'query=value',
//     'fragment' => 'fragment'
// ]
```

--------------------------------

### Custom parser initialization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of initializing the HtmlSanitizer with a custom parser instance.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;
use Symfony\Component\HtmlSanitizer\Parser\NativeParser;

$config = (new HtmlSanitizerConfig())->allowSafeElements();
$parser = new NativeParser();
$sanitizer = new HtmlSanitizer($config, $parser);
```

--------------------------------

### HTTPS Enforcement Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Demonstrates how to force HTTPS for URLs using the forceHttpsUrls configuration method.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->forceHttpsUrls(true);

$sanitizer = new HtmlSanitizer($config);
$result = $sanitizer->sanitize('<a href="http://example.com">Link</a>');
// Output: <a href=https://example.com>Link</a>
```

--------------------------------

### dropAttribute configuration example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how to remove specific attributes like event handlers or styles.

```php
$config = (new HtmlSanitizerConfig())
    ->allowStaticElements()
    ->dropAttribute('onclick', '*')  // Remove all event handlers
    ->dropAttribute('style', '*');
```

--------------------------------

### W3CReference Context Mapping

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/types.md

Example of how elements are mapped to specific contexts within the W3CReference configuration.

```php
W3CReference::CONTEXTS_MAP = [
    'head' => 'head',
    'textarea' => 'text',
    'title' => 'text',
]
```

--------------------------------

### HtmlSanitizerAction Usage Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/types.md

Demonstrates setting the default action on an HtmlSanitizerConfig instance and checking the current action.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerAction;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

// Set default action to Drop (default behavior)
$config = (new HtmlSanitizerConfig())
    ->defaultAction(HtmlSanitizerAction::Drop);

// Check the action
if ($config->getDefaultAction() === HtmlSanitizerAction::Allow) {
    // Elements are allowed by default
}
```

--------------------------------

### Parsing head context

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Example of parsing an HTML string within the 'head' context.

```php
$parser = new NativeParser();

$html = '<meta name="description" content="Test">';
$node = $parser->parse($html, 'head');
// Returns a node in head context
```

--------------------------------

### Host Validation Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Demonstrates how to whitelist specific hosts for URLs using allowLinkHosts. Subdomains of allowed hosts are also permitted.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->allowLinkHosts(['example.com']);

$sanitizer = new HtmlSanitizer($config);

// Allowed host
$sanitizer->sanitize('<a href="https://example.com">Link</a>');
// Output: <a href=https://example.com>Link</a>

// Subdomain (still allowed via domain matching)
$sanitizer->sanitize('<a href="https://sub.example.com">Link</a>');
// Output: <a href=https://sub.example.com>Link</a>

// Different host dropped
$sanitizer->sanitize('<a href="https://other.com">Link</a>');
// Output: <a>Link</a>
```

--------------------------------

### HtmlSanitizerInterface Dependency Injection Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/types.md

Shows how to type-hint the HtmlSanitizerInterface for dependency injection within a class.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerInterface;

class CommentFilter {
    public function __construct(private HtmlSanitizerInterface $sanitizer) {}
    
    public function filterComment(string $userComment): string {
        return $this->sanitizer->sanitize($userComment);
    }
}
```

--------------------------------

### Relative URL parsing example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Demonstrates how the parser handles relative paths where authority components are absent.

```php
$parts = UrlSanitizer::parse('/path/to/page');
// [
//     'scheme' => null,
//     'user' => null,
//     'pass' => null,
//     'host' => null,
//     'port' => null,
//     'path' => '/path/to/page',
//     'query' => null,
//     'fragment' => null
// ]
```

--------------------------------

### Empty input handling

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Examples showing how the parser handles empty strings, whitespace, or elements without children.

```php
$parser = new NativeParser();

$result = $parser->parse('', 'body');  // Returns null
$result = $parser->parse('   ', 'body');  // Returns null (whitespace trimmed)
$result = $parser->parse('<div></div>', 'body');  // Returns null (no children)
```

--------------------------------

### Usage of allowStaticElements()

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Example of initializing the sanitizer with the static elements preset. Note that this removes scripts but does not prevent CSS injection.

```php
$config = (new HtmlSanitizerConfig())->allowStaticElements();
// Use when you need broader element support but still prevent XSS
```

--------------------------------

### Configure Head Elements

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Example of configuring the HtmlSanitizerConfig to explicitly allow specific head elements and their attributes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('head')
    ->allowElement('meta', ['name', 'content'])
    ->allowElement('link', ['rel', 'href'])
    ->allowElement('title');
```

--------------------------------

### Attribute Sanitization Pipeline Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

A conceptual walkthrough of the attribute sanitization process for an anchor tag with a javascript href.

```text
Input: <a href="javascript:alert()">

Step 1: 'href' allowed on 'a'? Yes (configured)
Step 2: Run UrlAttributeSanitizer
        - Check scheme 'javascript' against allowedLinkSchemes
        - Scheme not in list → return null
Result: Attribute dropped
Output: <a>
```

--------------------------------

### Scheme Validation Example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Shows how to restrict allowed URL schemes using allowLinkSchemes. URLs with schemes not in the allowed list are removed.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->allowLinkSchemes(['https', 'mailto']);

$sanitizer = new HtmlSanitizer($config);

// HTTP dropped (not in allowed schemes)
$sanitizer->sanitize('<a href="http://example.com">Link</a>');
// Output: <a>Link</a>

// HTTPS allowed
$sanitizer->sanitize('<a href="https://example.com">Link</a>');
// Output: <a href=https://example.com>Link</a>

// Mailto allowed
$sanitizer->sanitize('<a href="mailto:user@example.com">Email</a>');
// Output: <a href=mailto:user@example.com>Email</a>
```

--------------------------------

### Parsing body context

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Example of parsing an HTML string within the 'body' context.

```php
$parser = new NativeParser();

$html = '<div>Hello <b>World</b></div>';
$node = $parser->parse($html, 'body');
// Returns a node representing the parsed HTML
```

--------------------------------

### Configure Safe Elements Only

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Example of configuring the HtmlSanitizerConfig to allow all safe elements from both head and body contexts.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
// Allows all safe elements from both HEAD_ELEMENTS and BODY_ELEMENTS
```

--------------------------------

### Basic sanitization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of sanitizing a string containing malicious script tags.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);

$dirty = '<div>Hello <script>alert("xss")</script> World</div>';
$clean = $sanitizer->sanitize($dirty);
// Output: '<div>Hello  World</div>'
```

--------------------------------

### Sanitizing for head context

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of sanitizing input specifically for the head element context.

```php
$config = (new HtmlSanitizerConfig())->allowStaticElements();
$sanitizer = new HtmlSanitizer($config);

$input = '<meta name="description" content="Test">';
$safe = $sanitizer->sanitizeFor('head', $input);
// Output: '<meta name=description content=Test />' (if meta is allowed in head)
```

--------------------------------

### Meta refresh validation example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Demonstrates how the sanitizer handles HTTPS and HTTP URLs within meta refresh tags based on allowed link schemes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('meta', ['content', 'http-equiv'])
    ->allowLinkSchemes(['https']);

$sanitizer = new HtmlSanitizer($config);

// HTTPS URL is allowed
$result = $sanitizer->sanitize('<meta http-equiv="refresh" content="5; url=https://example.com">');
// Output: <meta http-equiv=refresh content="5; url=https://example.com" />

// HTTP URL is dropped
$result = $sanitizer->sanitize('<meta http-equiv="refresh" content="5; url=http://example.com">');
// Output: <meta http-equiv=refresh /> (content attribute removed)
```

--------------------------------

### Handling invalid input with NativeParser

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Examples of how the parser handles empty input or invalid HTML structures for a given context by returning null.

```php
$parser = new NativeParser();

// Empty or whitespace input
$result = $parser->parse('   ', 'body');  // Returns null

// Invalid HTML structure (for given context)
$result = $parser->parse('<body>test</body>', 'title');  // May return null
```

--------------------------------

### withMaxInputLength() limit increase

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Sets the maximum allowed input string length in bytes. This example increases the limit to 100,000 bytes.

```php
$config = (new HtmlSanitizerConfig())
    ->withMaxInputLength(100_000);
```

--------------------------------

### Invalid input handling

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Examples of inputs that cause the parser to return null due to security or formatting violations.

```php
// BiDi character (rejected)
$parts = UrlSanitizer::parse('https://\u{202E}example.com');
// Output: null

// Unencoded space (rejected)
$parts = UrlSanitizer::parse('https://example.com/path with spaces');
// Output: null

// Malformed URL
$parts = UrlSanitizer::parse('ht!tp://invalid');
// Output: null (if League\Uri rejects it)
```

--------------------------------

### HTTPS forcing in meta refresh example

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

Demonstrates how to force HTTPS for URLs within meta refresh tags using the forceHttpsUrls configuration.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('meta', ['content', 'http-equiv'])
    ->forceHttpsUrls(true);

$sanitizer = new HtmlSanitizer($config);

$result = $sanitizer->sanitize('<meta http-equiv="refresh" content="5; url=http://example.com">');
// Output: <meta http-equiv=refresh content="5; url=https://example.com" />
```

--------------------------------

### Using the NativeParser directly

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Demonstrates how to instantiate the NativeParser and parse an HTML string into a DOM node.

```php
use Symfony\Component\HtmlSanitizer\Parser\NativeParser;

$parser = new NativeParser();

$html = '<p>Hello World</p>';
$domNode = $parser->parse($html, 'body');

if ($domNode) {
    echo "Parsing successful\n";
} else {
    echo "Parsing failed\n";
}
```

--------------------------------

### Configure and use HtmlSanitizer

Source: https://github.com/symfony/html-sanitizer/blob/8.2/README.md

Demonstrates how to instantiate HtmlSanitizerConfig to define sanitization rules, create an HtmlSanitizer instance, and sanitize input for different contexts.

```php
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;
use Symfony\Component\HtmlSanitizer\HtmlSanitizer;

// By default, an element not added to the allowed or blocked elements
// will be dropped, including its children
$config = (new HtmlSanitizerConfig())
    // Allow "safe" elements and attributes. All scripts will be removed
    // as well as other dangerous behaviors like CSS injection
    ->allowSafeElements()

    // Allow all static elements and attributes from the W3C Sanitizer API
    // standard. All scripts will be removed but the output may still contain
    // other dangerous behaviors like CSS injection (click-jacking), CSS
    // expressions, ...
    ->allowStaticElements()

    // Allow the "div" element and no attribute can be on it
    ->allowElement('div')

    // Allow the "a" element, and the "title" attribute to be on it
    ->allowElement('a', ['title'])

    // Allow the "span" element, and any attribute from the Sanitizer API is allowed
    // (see https://wicg.github.io/sanitizer-api/#default-configuration)
    ->allowElement('span', '*')

    // Block the "section" element: this element will be removed but
    // its children will be retained
    ->blockElement('section')

    // Drop the "div" element: this element will be removed, including its children
    ->dropElement('div')

    // Allow the attribute "title" on the "div" element
    ->allowAttribute('title', ['div'])

    // Allow the attribute "data-custom-attr" on all currently allowed elements
    ->allowAttribute('data-custom-attr', '*')

    // Drop the "data-custom-attr" attribute from the "div" element:
    // this attribute will be removed
    ->dropAttribute('data-custom-attr', ['div'])

    // Drop the "data-custom-attr" attribute from all elements:
    // this attribute will be removed
    ->dropAttribute('data-custom-attr', '*')

    // Forcefully set the value of all "rel" attributes on "a"
    // elements to "noopener noreferrer"
    ->forceAttribute('a', 'rel', 'noopener noreferrer')

    // Transform all HTTP schemes to HTTPS
    ->forceHttpsUrls()

    // Configure which schemes are allowed in links (others will be dropped)
    ->allowLinkSchemes(['https', 'http', 'mailto'])

    // Configure which hosts are allowed in links (by default all are allowed)
    ->allowLinkHosts(['symfony.com', 'example.com'])

    // Allow relative URL in links (by default they are dropped)
    ->allowRelativeLinks()

    // Configure which schemes are allowed in img/audio/video/iframe (others will be dropped)
    ->allowMediaSchemes(['https', 'http'])

    // Configure which hosts are allowed in img/audio/video/iframe (by default all are allowed)
    ->allowMediaHosts(['symfony.com', 'example.com'])

    // Allow relative URL in img/audio/video/iframe (by default they are dropped)
    ->allowRelativeMedias()

    // Configure a custom attribute sanitizer to apply custom sanitization logic
    // ($attributeSanitizer instance of AttributeSanitizerInterface)
    ->withAttributeSanitizer($attributeSanitizer)

    // Unregister a previously registered attribute sanitizer
    // ($attributeSanitizer instance of AttributeSanitizerInterface)
    ->withoutAttributeSanitizer($attributeSanitizer)
;

$sanitizer = new HtmlSanitizer($config);

// Sanitize a given string, using the configuration provided and in the
// "body" context (tags only allowed in <head> will be removed)
$sanitizer->sanitize($userInput);

// Sanitize the given string for a usage in a <head> tag
$sanitizer->sanitizeFor('head', $userInput);

// Sanitize the given string for a usage in another tag
$sanitizer->sanitizeFor('title', $userInput); // Will encode as HTML entities
$sanitizer->sanitizeFor('textarea', $userInput); // Will encode as HTML entities
$sanitizer->sanitizeFor('div', $userInput); // Will sanitize as body
$sanitizer->sanitizeFor('section', $userInput); // Will sanitize as body
// ...
```

--------------------------------

### Inspecting HtmlSanitizerConfig configuration

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Demonstrates how to configure elements and retrieve the resulting allowed elements array.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->allowElement('div', []);

$allowed = $config->getAllowedElements();
// ['a' => ['href' => true], 'div' => []]
```

--------------------------------

### Immutability and Thread Safety with HtmlSanitizerConfig

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Demonstrates how configuration methods return a cloned instance, ensuring that base configurations remain independent and safe for concurrent use.

```php
$base = (new HtmlSanitizerConfig())->allowSafeElements();
$strict = $base->dropElement('a');
$permissive = $base->allowElement('b', '*');

// $base, $strict, $permissive are independent
// Safe to use in concurrent code
```

--------------------------------

### Handling malicious input

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of removing malicious attributes like onerror from an image tag.

```php
$userInput = '<img src=x onerror="alert(\'xss\')">';
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);

$safe = $sanitizer->sanitize($userInput);
// Output: '<img src=x />' (onerror removed, src dropped if not allowed)
```

--------------------------------

### Creating a configuration

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Instantiates a new HtmlSanitizerConfig with default settings, which drop all unknown elements and block all attributes.

```php
$config = new HtmlSanitizerConfig();
// Returns a config with default settings
```

--------------------------------

### Empty Configuration Preset

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Initializes an empty configuration where all elements are dropped by default, providing the most secure baseline.

```php
$config = new HtmlSanitizerConfig();
```

--------------------------------

### Sanitizing for text-only context

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Example of sanitizing input for a text-only context like title, where content is HTML-encoded.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);

$input = '<b>Bold text</b>';
$safe = $sanitizer->sanitizeFor('title', $input);
// Output: '&lt;b&gt;Bold text&lt;/b&gt;' (HTML entities encoded)
```

--------------------------------

### Handle Errors and Edge Cases

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/INDEX.md

Demonstrates handling configuration exceptions, empty input behavior, and invalid URL sanitization results.

```php
try {
    $config = (new HtmlSanitizerConfig())
        ->withMaxInputLength(-5);  // InvalidArgumentException
} catch (InvalidArgumentException $e) {
    // Handle error
}

// Empty input returns empty string
$output = $sanitizer->sanitize('');  // ''

// Invalid URLs return null
$url = UrlSanitizer::sanitize('javascript:alert()');  // null
```

--------------------------------

### Minimal Configuration

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

A configuration that drops all elements by default, providing maximum security.

```php
$config = new HtmlSanitizerConfig();
// Drops all elements by default
// Only explicitly allowed elements and attributes pass through
```

--------------------------------

### allowStaticElements() usage

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Allows all standard W3C elements, including potentially dangerous ones like <style>, <audio>, and <video>.

```php
$config = (new HtmlSanitizerConfig())->allowStaticElements();
// Allows all standard elements including <style>, <audio>, <video>
```

--------------------------------

### Configuring URL Policies

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

Sets strict policies for links and media, including allowed schemes, hosts, and HTTPS enforcement.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->allowElement('img', ['src'])
    
    // Link configuration
    ->allowLinkSchemes(['https', 'mailto'])
    ->allowLinkHosts(['example.com', 'trusted.org'])
    ->forceHttpsUrls(true)
    ->allowRelativeLinks(false)
    
    // Media configuration
    ->allowMediaSchemes(['https', 'data'])
    ->allowMediaHosts(['cdn.example.com'])
    ->allowRelativeMedias(false);
```

--------------------------------

### Testing HTML Sanitization with HtmlSanitizerConfig

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Shows how to verify if HTML content survives sanitization based on a provided configuration.

```php
function testSanitization(string $html, HtmlSanitizerConfig $config): bool {
    $sanitizer = new HtmlSanitizer($config);
    $result = $sanitizer->sanitize($html);
    return $result !== '';  // Check if any content survives
}

// Test cases
$config = (new HtmlSanitizerConfig())->allowSafeElements();
echo testSanitization('<b>Bold</b>', $config) ? 'PASS' : 'FAIL';  // Should pass
echo testSanitization('<script>alert()</script>', $config) ? 'PASS' : 'FAIL';  // Should fail
```

--------------------------------

### Implementing a Custom Parser

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/Parser.md

Create a custom parser by implementing the ParserInterface and passing an instance to the HtmlSanitizer.

```php
use Symfony\Component\HtmlSanitizer\Parser\ParserInterface;

class CustomParser implements ParserInterface {
    public function parse(string $html, string $context = 'body'): \Dom\Node|\DOMNode|null {
        // Custom parsing logic
        if (empty(trim($html))) {
            return null;
        }
        
        // Use your preferred parsing library
        // Return a DOM node tree or null
        return null;  // Placeholder
    }
}

$parser = new CustomParser();
$sanitizer = new HtmlSanitizer($config, $parser);
```

--------------------------------

### Configure Maximum Security Minimal Allowlist

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

Drops all elements by default, allowing only explicitly defined elements to pass through the sanitizer.

```php
$config = new HtmlSanitizerConfig();
// Drops all elements; only explicitly allowed elements pass
```

--------------------------------

### ParserInterface::parse() null return cases

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Examples of inputs that cause ParserInterface::parse() to return null, including empty input, nodes without children, and parse errors.

```php
$parser->parse('', 'body');     // null
$parser->parse('   ', 'body');  // null
```

```php
$parser->parse('<div></div>', 'body');  // null (empty div has no children)
```

```php
$parser->parse('{{{invalid}}}', 'body');  // null (may vary by parser)
```

--------------------------------

### UrlSanitizer::sanitize() null return cases

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Examples of inputs that cause UrlSanitizer::sanitize() to return null, including empty input, forbidden characters, disallowed schemes, disallowed hosts, relative URLs, and malformed URLs.

```php
UrlSanitizer::sanitize(null);      // null
UrlSanitizer::sanitize('');        // null
UrlSanitizer::sanitize('   ');     // null
```

```php
UrlSanitizer::sanitize("https://example.com\npath");  // null (newline)
UrlSanitizer::sanitize("https://example.com\tpath");  // null (tab)
```

```php
UrlSanitizer::sanitize('javascript:alert("xss")', ['https']);  // null
```

```php
UrlSanitizer::sanitize(
    'https://untrusted.com',
    ['https'],
    false,
    ['example.com']
);  // null
```

```php
UrlSanitizer::sanitize('/path', null, false, null, false);  // null
```

```php
UrlSanitizer::sanitize('ht!tp://invalid');  // null
```

--------------------------------

### Minimal HtmlSanitizerConfig

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/INDEX.md

Creates a configuration that drops all elements by default, providing the most secure baseline.

```php
new HtmlSanitizerConfig()  // Drops everything
```

--------------------------------

### allowElement() with all standard attributes

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Configures an element to be allowed with all standard W3C attributes by passing '*' as the second argument.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('span', '*');
```

--------------------------------

### Optimizing Performance with Repeated Context Sanitization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Demonstrates how the sanitizer caches DOM visitors per context to improve performance during repeated calls.

```php
$sanitizer = new HtmlSanitizer($config);

for ($i = 0; $i < 1000; $i++) {
    $sanitizer->sanitizeFor('body', $html);   // Fast (cached)
    $sanitizer->sanitizeFor('head', $html2);  // Fast (cached)
}
// Only two DOM visitors created (one per context)
```

--------------------------------

### Configuring Max Input Length

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Uses withMaxInputLength to limit input size and prevent potential Denial of Service attacks.

```php
$config = (new HtmlSanitizerConfig())
    ->allowSafeElements()
    ->withMaxInputLength(100_000);  // Prevents DOS on very large inputs
```

--------------------------------

### withMaxInputLength(int $maxInputLength)

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Sets the maximum allowed input string length in bytes.

```APIDOC
## withMaxInputLength(int $maxInputLength)

### Description
Sets the maximum allowed input string length in bytes. Inputs exceeding this length are truncated before parsing. Default is 20,000 bytes. Pass -1 to disable length limiting.

### Parameters
- **$maxInputLength** (int) - Required - Maximum input length in bytes, or -1 for no limit

### Return Type
static (New cloned configuration instance)

### Throws
- InvalidArgumentException - If $maxInputLength is less than -1
```

--------------------------------

### Configure URL Policies

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/00-START-HERE.txt

Enforce HTTPS for URLs and restrict allowed link hosts.

```php
$config->forceHttpsUrls(true)->allowLinkHosts(['example.com']);
```

--------------------------------

### Validate input length before configuring HtmlSanitizerConfig

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Shows the recommended way to validate the input length before calling withMaxInputLength() to avoid exceptions.

```php
$maxLength = 100_000;

if ($maxLength >= -1) {
    $config = (new HtmlSanitizerConfig())
        ->withMaxInputLength($maxLength);
}
```

--------------------------------

### Context Mapping and Fallback

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Elements map to specific contexts, with unknown elements defaulting to the body context.

```php
use Symfony\Component\HtmlSanitizer\Reference\W3CReference;

// Known mappings
W3CReference::CONTEXTS_MAP = [
    'head' => 'head',     // Head context
    'textarea' => 'text',  // Text context (HTML-encode)
    'title' => 'text',     // Text context (HTML-encode)
];

// Unknown elements default to 'body' context
```

```php
$config = (new HtmlSanitizerConfig())->allowStaticElements();
$sanitizer = new HtmlSanitizer($config);

// 'title' → text context → HTML-encodes content
$output = $sanitizer->sanitizeFor('title', '<b>Bold</b>');
// Output: '&lt;b&gt;Bold&lt;/b&gt;'

// 'custom' → body context (unknown element)
$output = $sanitizer->sanitizeFor('custom', '<p>Text</p>');
// Output depends on whether 'p' is allowed
```

--------------------------------

### Using Wildcard Attribute Allowance

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Shows how to use the '*' wildcard to allow all safe attributes on an element, or override defaults for specific elements.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('div', '*');  // All safe attributes on div

$config = (new HtmlSanitizerConfig())
    ->allowStaticElements()
    ->allowElement('span', '*');  // All attributes on span (override safe default)
```

--------------------------------

### Rejecting Nested View-Source URLs

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Single view-source URLs are allowed, but nested view-source URLs are rejected.

```php
UrlSanitizer::sanitize('view-source:https://example.com');
// Output: 'view-source:https://example.com' (allowed)

UrlSanitizer::sanitize('view-source:view-source:https://example.com');
// Output: null (nested view-source rejected)
```

--------------------------------

### Handle Context-Specific Content

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/00-START-HERE.txt

Sanitize content specifically for certain HTML contexts like head or title tags.

```php
$sanitizer->sanitizeFor('head', $metaTags);
$sanitizer->sanitizeFor('title', $pageTitle);
```

--------------------------------

### getSupportedElements Method Signature

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

The method signature for defining which elements a sanitizer supports.

```php
public function getSupportedElements(): ?array
```

--------------------------------

### HtmlSanitizerConfig Getter Methods

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

A list of read-only methods available in HtmlSanitizerConfig to retrieve current configuration values.

```php
public function getDefaultAction(): HtmlSanitizerAction
public function getAllowedElements(): array  // array<string, array<string, true>>
public function getBlockedElements(): array  // array<string, true>
public function getDroppedElements(): array  // array<string, true>
public function getForcedAttributes(): array  // array<string, array<string, string>>
public function getAllowedLinkSchemes(): array  // list<string>
public function getAllowedLinkHosts(): ?array  // list<string>|null
public function getAllowRelativeLinks(): bool
public function getAllowedMediaSchemes(): array  // list<string>
public function getAllowedMediaHosts(): ?array  // list<string>|null
public function getAllowRelativeMedias(): bool
public function getForceHttpsUrls(): bool
public function getMaxInputLength(): int
public function getAttributeSanitizers(): array  // list<AttributeSanitizerInterface>
```

--------------------------------

### Basic URL sanitization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Demonstrates basic usage of the sanitize method, including handling of disallowed schemes, null inputs, and empty strings.

```php
use Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer;

// Allowed URL
$result = UrlSanitizer::sanitize('https://example.com/page');
// Output: 'https://example.com/page'

// Disallowed scheme
$result = UrlSanitizer::sanitize('javascript:alert("xss")');
// Output: null

// No input
$result = UrlSanitizer::sanitize(null);
// Output: null

// Empty string
$result = UrlSanitizer::sanitize('');
// Output: null
```

--------------------------------

### HtmlSanitizer::__construct

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

Creates a new HtmlSanitizer instance with the given configuration and optional parser.

```APIDOC
## __construct(HtmlSanitizerConfig $config, ?ParserInterface $parser = null)

### Description
Creates a new `HtmlSanitizer` instance with the given configuration. The parser defaults to the native PHP 8.4 DOM API parser if not specified.

### Parameters
- **$config** (HtmlSanitizerConfig) - Required - Configuration object defining sanitization rules
- **$parser** (ParserInterface|null) - Optional - HTML parser instance; defaults to `null`
```

--------------------------------

### allowSafeElements() Method Definition

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Defines the allowSafeElements method which uses a pre-configured set of safe elements and attributes from the W3C standard.

```php
public function allowSafeElements(): static
```

--------------------------------

### allowMediaHosts()

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Restricts media URLs to specific allowed hosts.

```APIDOC
## allowMediaHosts(?array $allowMediaHosts)

### Description
Restricts media URLs to specific hosts. This applies to media elements like images and videos.

### Parameters
- **$allowMediaHosts** (list<string>|null) - Required - List of allowed hosts, or null to allow all hosts

### Return Type
static - New cloned configuration instance
```

--------------------------------

### Basic HTML Sanitization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/00-START-HERE.txt

Perform basic sanitization by creating a configuration object with safe elements and applying it to user input.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);
$safe = $sanitizer->sanitize($userInput);
```

--------------------------------

### Testing URL Validation with UrlSanitizer

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Demonstrates how to validate URLs against specific schemes, hosts, and security requirements using the UrlSanitizer class.

```php
function testUrlValidation(string $url, ?array $schemes, ?array $hosts, bool $https, bool $relative) {
    $result = UrlSanitizer::sanitize($url, $schemes, $https, $hosts, $relative);
    return $result ?? 'REJECTED';
}

// Test cases
echo testUrlValidation('https://example.com', ['https'], null, false, false);  // URL
echo testUrlValidation('http://example.com', ['https'], null, true, false);   // HTTPS (forced)
echo testUrlValidation('/path', null, null, false, true);                      // Relative (allowed)
echo testUrlValidation('javascript:alert()', null, null, false, false);       // Rejected
```

--------------------------------

### Permissive Configuration

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

A configuration that allows all elements except for specific ones like script and iframe.

```php
$config = (new HtmlSanitizerConfig())
    ->defaultAction(HtmlSanitizerAction::Allow)
    ->dropElement('script')
    ->dropElement('iframe');
// All elements allowed except script/iframe, all attributes allowed
```

--------------------------------

### HtmlSanitizerConfig Getter Methods

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

A collection of read-only methods to retrieve the current configuration settings of the HtmlSanitizerConfig instance.

```APIDOC
## HtmlSanitizerConfig Getter Methods

### Description
These methods allow for the retrieval of configuration values from an `HtmlSanitizerConfig` instance.

### Methods
- `getDefaultAction(): HtmlSanitizerAction` - Returns the default action for elements.
- `getAllowedElements(): array` - Returns the list of allowed elements and their attributes.
- `getBlockedElements(): array` - Returns the list of blocked elements.
- `getDroppedElements(): array` - Returns the list of dropped elements.
- `getForcedAttributes(): array` - Returns the list of forced attributes.
- `getAllowedLinkSchemes(): array` - Returns the list of allowed link schemes.
- `getAllowedLinkHosts(): ?array` - Returns the list of allowed link hosts or null.
- `getAllowRelativeLinks(): bool` - Returns whether relative links are allowed.
- `getAllowedMediaSchemes(): array` - Returns the list of allowed media schemes.
- `getAllowedMediaHosts(): ?array` - Returns the list of allowed media hosts or null.
- `getAllowRelativeMedias(): bool` - Returns whether relative media is allowed.
- `getForceHttpsUrls(): bool` - Returns whether HTTPS is forced for URLs.
- `getMaxInputLength(): int` - Returns the maximum allowed input length.
- `getAttributeSanitizers(): array` - Returns the list of configured attribute sanitizers.
```

--------------------------------

### Balanced Configuration

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

A configuration that combines safe elements with specific allowed attributes and link restrictions.

```php
$config = (new HtmlSanitizerConfig())
    ->allowSafeElements()
    ->allowElement('img', ['src', 'alt'])
    ->allowElement('a', ['href', 'title'])
    ->forceHttpsUrls(true)
    ->allowLinkSchemes(['https', 'mailto'])
    ->allowLinkHosts(['example.com']);
```

--------------------------------

### HtmlSanitizerConfig::__construct

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Creates a new HtmlSanitizerConfig instance with default settings, including pre-registered URL and MetaRefresh attribute sanitizers.

```APIDOC
## public function __construct()

### Description
Creates a new `HtmlSanitizerConfig` instance with default settings. By default, a configuration drops all unknown elements and blocks no attributes.
```

--------------------------------

### Relative URL handling

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Configures whether relative URLs are permitted or rejected.

```php
// Relative URLs rejected by default
$result = UrlSanitizer::sanitize(
    '/path/to/page',
    null,
    false,
    null,
    false  // allowRelative
);
// Output: null

// Relative URLs allowed
$result = UrlSanitizer::sanitize(
    '/path/to/page',
    null,
    false,
    null,
    true  // allowRelative
);
// Output: '/path/to/page'

$result = UrlSanitizer::sanitize(
    '../other/page',
    null,
    false,
    null,
    true
);
// Output: '../other/page'
```

--------------------------------

### Constructor signature

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizer.md

The constructor for the HtmlSanitizer class.

```php
public function __construct(
    HtmlSanitizerConfig $config,
    ?ParserInterface $parser = null,
)
```

--------------------------------

### Handle LogicException in TextNode

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Demonstrates catching a LogicException when attempting to add a child to a TextNode, which is not permitted.

```php
use Symfony\Component\HtmlSanitizer\Visitor\Node\TextNode;

$textNode = new TextNode($parent, 'text content');

try {
    $textNode->addChild($childNode);  // Throws LogicException
} catch (LogicException $e) {
    echo "Error: " . $e->getMessage();
    // "Text nodes cannot have children."
}
```

--------------------------------

### allowElement method signature

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Defines the method signature for configuring elements to retain in the output.

```php
public function allowElement(string $element, array|string $allowedAttributes = []): static
```

--------------------------------

### Context-Aware Sanitization

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

Demonstrates sanitizing content for different HTML contexts like body, head, or title tags.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
$sanitizer = new HtmlSanitizer($config);

// Sanitize for body (default)
$sanitizer->sanitize('<p>Content</p>');

// Sanitize for head (allows head elements only)
$sanitizer->sanitizeFor('head', '<meta name="description" content="Test">');

// Sanitize for text (HTML-encodes content)
$sanitizer->sanitizeFor('title', '<b>Bold</b> text');
// Output: '&lt;b&gt;Bold&lt;/b&gt; text'
```

--------------------------------

### allowElement() with no attributes

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Configures specific elements to be allowed without permitting any attributes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('div')
    ->allowElement('p');
```

--------------------------------

### Configure Safe HTML W3C Elements

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

Allows standard text formatting, links, lists, and tables while removing scripts and dangerous behaviors.

```php
$config = (new HtmlSanitizerConfig())
    ->allowSafeElements();
// Allows safe text formatting, links, lists, tables
// Removes scripts and dangerous behaviors
```

--------------------------------

### parse() method signature

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

The static method signature for parsing a URL string.

```php
public static function parse(string $url): ?array
```

--------------------------------

### Chaining Attribute Sanitizers

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/error-handling.md

Shows how to register multiple custom attribute sanitizers within the HtmlSanitizerConfig.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('a', ['href'])
    ->withAttributeSanitizer($customSanitizer1)
    ->withAttributeSanitizer($customSanitizer2)
    ->withAttributeSanitizer($customSanitizer3);
// All sanitizers called for matching attributes
```

--------------------------------

### allowSafeElements() usage

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Allows safe elements and attributes according to W3C standards, removing scripts and CSS injection risks.

```php
$config = (new HtmlSanitizerConfig())->allowSafeElements();
// Allows safe elements like <b>, <i>, <a>, <p>, <div>, etc.
```

--------------------------------

### Allow Safe Attributes on Safe Elements

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Use the pre-configured method to allow a default set of safe elements and their corresponding safe attributes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowSafeElements();  // Pre-configured: safe elements with safe attributes
```

--------------------------------

### getSupportedAttributes Method Signature

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/AttributeSanitizers.md

The method signature for defining which attributes a sanitizer supports.

```php
public function getSupportedAttributes(): ?array
```

--------------------------------

### withMaxInputLength

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Limits input string size to prevent DOS attacks.

```APIDOC
## public function withMaxInputLength(int $maxInputLength): static

### Description
Limits input string size to prevent DOS attacks. Inputs exceeding the limit are truncated before parsing.

### Parameters
- **$maxInputLength** (int) - Required - Bytes; -1 for no limit (default: 20,000)

### Example
```php
$config = (new HtmlSanitizerConfig())
    ->withMaxInputLength(100_000);
```
```

--------------------------------

### Sanitization Usage

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/types.md

Demonstrates how the HTMLSanitizer creates a tree of NodeInterface implementations internally during the sanitization process.

```php
$sanitizer = new HtmlSanitizer($config);
$output = $sanitizer->sanitize($userInput);
// Internally creates a tree of NodeInterface implementations
```

--------------------------------

### allowMediaHosts() usage

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Restricts media URLs to specific hosts, similar to how allowLinkHosts() functions for links.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('img', ['src'])
    ->allowMediaHosts(['cdn.example.com', 'images.example.com']);
```

--------------------------------

### Allowing Data Attributes

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Demonstrates how to explicitly allow specific data-* attributes on an element using the HtmlSanitizerConfig.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('div', ['data-id', 'data-category', 'data-config']);

$sanitizer = new HtmlSanitizer($config);
$output = $sanitizer->sanitize('<div data-id="123" data-category="test">Content</div>');
// Preserves data-* attributes if explicitly allowed
```

--------------------------------

### Configure Media Schemes

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/configuration.md

Restricts URL schemes in media attributes using allowMediaSchemes.

```php
$config = (new HtmlSanitizerConfig())
    ->allowElement('img', ['src'])
    ->allowMediaSchemes(['https', 'data']);  // Allow HTTPS and data: URLs
```

--------------------------------

### Architecture Overview Diagram

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/INDEX.md

Visual representation of the data flow from input HTML string through the parser, DOM visitor, and renderer to the final output.

```text
Input HTML String
        ↓
Parser (NativeParser)
        ↓
DOM Tree
        ↓
DomVisitor (walks tree)
        ├→ Element validation (allowed/blocked/dropped)
        ├→ Attribute filtering
        └→ Attribute sanitizers (URL, meta refresh, custom)
        ↓
Sanitized Node Tree
        ↓
Render to HTML String
        ↓
Output HTML
```

--------------------------------

### forceHttpsUrls(bool $forceHttpsUrls = true)

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Transforms HTTP scheme URLs to HTTPS for all links and media attributes.

```APIDOC
## forceHttpsUrls(bool $forceHttpsUrls = true)

### Description
Transforms HTTP scheme URLs to HTTPS. Applies to all URLs in links and media attributes. This is useful for ensuring all external resources are loaded over secure connections.

### Parameters
- **$forceHttpsUrls** (bool) - Optional - Whether to transform HTTP to HTTPS (Default: true)

### Return Type
static (New cloned configuration instance)
```

--------------------------------

### Configure Rich Text Editor Content

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

A robust configuration for rich text editors that allows static elements, restricts dangerous attributes and tags, forces HTTPS, and limits link hosts.

```php
$config = (new HtmlSanitizerConfig())
    ->allowStaticElements()
    ->dropElement('script')
    ->dropElement('iframe')
    ->dropAttribute('onclick', '*')
    ->forceHttpsUrls(true)
    ->allowLinkHosts(['example.com']);
```

--------------------------------

### Configure Rich Content Static Elements

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/README.md

Allows a broader set of static elements while explicitly dropping script and iframe tags. Note that this configuration may allow CSS injection.

```php
$config = (new HtmlSanitizerConfig())
    ->allowStaticElements()
    ->dropElement('script')
    ->dropElement('iframe');
// Allows broader element set
// Still removes scripts but may allow CSS injection
```

--------------------------------

### HtmlSanitizerConfig::allowSafeElements

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/HtmlSanitizerConfig.md

Configures the sanitizer to allow all elements and attributes deemed safe by the W3C Sanitizer API standard.

```APIDOC
## public function allowSafeElements(): static

### Description
Allows all "safe" elements and their safe attributes according to the W3C Sanitizer API standard. Removes all scripts and dangerous behaviors like CSS injection.
```

--------------------------------

### Allow Static Elements Preset

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/w3c-reference.md

Configures the sanitizer to allow all elements and standard attributes while removing scripts, though CSS injection remains possible.

```php
$config = (new HtmlSanitizerConfig())->allowStaticElements();
```

--------------------------------

### Sanitize view-source URLs

Source: https://github.com/symfony/html-sanitizer/blob/8.2/_autodocs/api-reference/UrlSanitizer.md

Demonstrates the behavior of UrlSanitizer when processing view-source URLs, showing that single instances are allowed while nested instances are rejected.

```php
// Allowed
UrlSanitizer::sanitize('view-source:https://example.com');

// Rejected (nested view-source)
UrlSanitizer::sanitize('view-source:view-source:https://example.com');
```
Tokens:
Raw