HtmlSanitizeEx

https://html-sanitize-ex.hexdocs.pm/
Admin
HtmlSanitizeEx is an Elixir library for sanitizing potentially malicious user input by stripping or...
Tokens:3,500
Snippets:31
Trust Score:9
Update:1 day ago
Show doc for...
Tokens:
Raw
### use HtmlSanitizeEx (custom scrubber)

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Creates a custom scrubber module that allows specific tags and attributes.

```APIDOC
## use HtmlSanitizeEx

### Description
Creates a custom scrubber module that allows specific tags and attributes.

### Usage
```elixir
defmodule MyMostBasicScrubber do
  use HtmlSanitizeEx

  allow_tag_with_these_attributes("p", ["class"])
end
```

### Macro Options
- `extend:` - Optional - Extend an existing scrubber (e.g., `:basic_html`, `:html5`, `:markdown_html`, `:strip_tags`, or a custom scrubber module).

### Functions Generated
- `sanitize/1` - Sanitizes the input HTML according to the defined rules.

### Example
```elixir
MyMostBasicScrubber.sanitize("<p class=\"success\" title=\"Success!\"><strong>Granted</strong> access!</p>")
# => "<p class=\"success\">Granted access!</p>"
```
```

--------------------------------

### Custom Scrubber Creation

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.html

Create custom scrubbers using the use HtmlSanitizeEx macro and allow_tag_with_these_attributes/2 or allow_tag_with_any_attributes/1.

```APIDOC
## Custom Scrubber Creation

### Description
HtmlSanitizeEx can be used to implement custom scrubbers. Use the `use HtmlSanitizeEx` macro and then call `allow_tag_with_these_attributes/2` or `allow_tag_with_any_attributes/1` to define allowed tags and attributes.

### Usage
```elixir
defmodule MyMostBasicScrubber do
  use HtmlSanitizeEx

  allow_tag_with_these_attributes("p", ["class"])
end
```

This creates a scrubber that only allows `p` tags, optionally with a `class` attribute.

### Example
```elixir
MyMostBasicScrubber.sanitize("<p class=\"success\" title=\"Success!\"><strong>Granted</strong> access!</p>")
# => "<p class=\"success\">Granted access!</p>"
```
```

--------------------------------

### HtmlSanitizeEx.noscrub/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Scrubs neither tags, nor their attributes.

```APIDOC
## HtmlSanitizeEx.noscrub/1

### Description
Scrubs neither tags, nor their attributes.

### Function
`noscrub(html)`

### Parameters
- **html** (string) - Required - The HTML string to sanitize.

### Returns
- The input string unchanged.
```

--------------------------------

### Extend basic_html scrubber with allow_tag_with_any_attributes

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Defines a custom scrubber that extends the :basic_html scrubber and allows 'p' tags with any attribute. Uses 'use HtmlSanitizeEx, extend: :basic_html' and 'allow_tag_with_any_attributes'.

```elixir
defmodule MyScrubber do
  use HtmlSanitizeEx, extend: :basic_html

  allow_tag_with_any_attributes("p")
end
```

--------------------------------

### HtmlSanitizeEx.basic_html/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Allows basic HTML tags to support user input for writing relatively plain text but allowing headings, links, bold, and so on. Does not allow any styling, HTML5 tags, video embeds etc.

```APIDOC
## HtmlSanitizeEx.basic_html/1

### Description
Allows basic HTML tags to support user input for writing relatively plain text but allowing headings, links, bold, and so on. Does not allow any styling, HTML5 tags, video embeds etc.

### Function
`basic_html(html)`

### Parameters
- **html** (string) - Required - The HTML string to sanitize.

### Returns
- Sanitized string with basic HTML tags allowed.
```

--------------------------------

### Extending Existing Scrubbers

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.html

Extend existing scrubbers (like :basic_html, :html5, :markdown_html, :strip_tags) or custom scrubbers using the extend option in use HtmlSanitizeEx.

```APIDOC
## Extending Existing Scrubbers

### Description
Implementing scrubbers from scratch can be daunting, which is why HtmlSanitizeEx also supports extending existing scrubbers. Use `use HtmlSanitizeEx, extend: :basic_html` or extend a custom scrubber.

### Usage
```elixir
defmodule MyScrubber do
  use HtmlSanitizeEx, extend: :basic_html

  allow_tag_with_any_attributes("p")
end
```

This creates a scrubber working exactly like `HtmlSanitizeEx.basic_html/1`, but allows `p` tags with _any_ attribute.

You can extend `:basic_html`, `:html5`, `:markdown_html` and `:strip_tags`.

You can also extend any custom scrubber you created:

```elixir
defmodule FooBarScrubber do
  use HtmlSanitizeEx, extend: MyMostBasicScrubber

  allow_tag_with_these_attributes("p", ["title"])
end
```

### Example
```elixir
FooBarScrubber.sanitize("<p class=\"success\" title=\"Success!\"><strong>Granted</strong> access!</p>")
# => "<p class=\"success\" title=\"Success!\">Granted access!</p>"
```
```

--------------------------------

### Create custom scrubber with allow_tag_with_these_attributes

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Defines a custom scrubber module that only allows 'p' tags with a 'class' attribute. Uses the 'use HtmlSanitizeEx' macro and the 'allow_tag_with_these_attributes' function.

```elixir
defmodule MyMostBasicScrubber do
  use HtmlSanitizeEx

  allow_tag_with_these_attributes("p", ["class"])
end
```

--------------------------------

### HtmlSanitizeEx.markdown_html/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Allows basic HTML tags to support user input for writing relatively plain text with Markdown (GitHub flavoured Markdown supported). Technically a more relaxed version of the BasicHTML scrubber. Does not allow any styling, HTML5 tags, video embeds etc.

```APIDOC
## HtmlSanitizeEx.markdown_html/1

### Description
Allows basic HTML tags to support user input for writing relatively plain text with Markdown (GitHub flavoured Markdown supported). Technically a more relaxed version of the BasicHTML scrubber. Does not allow any styling, HTML5 tags, video embeds etc.

### Function
`markdown_html(html)`

### Parameters
- **html** (string) - Required - The HTML string to sanitize.

### Returns
- Sanitized string with basic HTML tags allowed for Markdown output.
```

--------------------------------

### HtmlSanitizeEx.html5/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Allows all HTML5 tags to support user input. Sanitizes all malicious content.

```APIDOC
## HtmlSanitizeEx.html5/1

### Description
Allows all HTML5 tags to support user input. Sanitizes all malicious content.

### Function
`html5(html)`

### Parameters
- **html** (string) - Required - The HTML string to sanitize.

### Returns
- Sanitized string with HTML5 tags allowed.
```

--------------------------------

### Sanitize with MyMostBasicScrubber

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

IEx session showing the output of MyMostBasicScrubber.sanitize/1. The input contains a 'p' tag with class and title attributes, and a 'strong' tag. The output strips the title attribute and the 'strong' tag, leaving only the 'p' tag with class.

```elixir
iex(1)> MyMostBasicScrubber.sanitize(
...(2)>   "<p class=\"success\" title=\"Success!\"><strong>Granted</strong> access!</p>")
"<p class=\"success\">Granted access!</p>"
```

--------------------------------

### Sanitize with FooBarScrubber

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

IEx session showing the output of FooBarScrubber.sanitize/1. The input contains a 'p' tag with class and title attributes, and a 'strong' tag. The output keeps both class and title attributes but strips the 'strong' tag.

```elixir
iex(1)> FooBarScrubber.sanitize(
...(2)>   "<p class=\"success\" title=\"Success!\"><strong>Granted</strong> access!</p>")
"<p class=\"success\" title=\"Success!\">Granted access!</p>"
```

--------------------------------

### allow_tag_with_any_attributes/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Allows a specific tag with any attributes.

```APIDOC
## allow_tag_with_any_attributes/1

### Description
Allows a specific tag with any attributes.

### Function
`allow_tag_with_any_attributes(tag)`

### Parameters
- **tag** (string) - Required - The HTML tag to allow.

### Returns
- Updates the scrubber configuration.
```

--------------------------------

### Extend custom scrubber with allow_tag_with_these_attributes

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Defines a custom scrubber that extends MyMostBasicScrubber and allows 'p' tags with 'title' attribute in addition to 'class'. Uses 'use HtmlSanitizeEx, extend: MyMostBasicScrubber'.

```elixir
defmodule FooBarScrubber do
  use HtmlSanitizeEx, extend: MyMostBasicScrubber

  allow_tag_with_these_attributes("p", ["title"])
end
```

--------------------------------

### allow_tag_with_these_attributes/2

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Allows a specific tag with a list of allowed attributes.

```APIDOC
## allow_tag_with_these_attributes/2

### Description
Allows a specific tag with a list of allowed attributes.

### Function
`allow_tag_with_these_attributes(tag, attributes)`

### Parameters
- **tag** (string) - Required - The HTML tag to allow.
- **attributes** (list of strings) - Required - List of attribute names allowed on the tag.

### Returns
- Updates the scrubber configuration.
```

--------------------------------

### HtmlSanitizeEx.strip_tags/1

Source: https://html-sanitize-ex.hexdocs.pm/HtmlSanitizeEx.md

Strips all HTML tags from the input string.

```APIDOC
## HtmlSanitizeEx.strip_tags/1

### Description
Strips all HTML tags (and attributes) from the input string.

### Function
`strip_tags(html)`

### Parameters
- **html** (string) - Required - The HTML string to sanitize.

### Returns
- Sanitized string with all tags removed.
```
Tokens:
Raw