🥮 mooncakes.io
README

bobzhang/html_parser/sanitize does not have a README file

#
DisallowedTagHandling

source
pub(all) enum DisallowedTagHandling {
  Unwrap
  Escape
  Drop
} derive(Eq, 
Debug)

How sanitizer handles elements whose tag names are not allowlisted.

#
SanitizationPolicy

source
pub struct SanitizationPolicy {
  // private fields
} derive(
Debug)

DOM sanitization policy.

A policy controls allowed tags and attributes, URL filtering, comment and doctype handling, foreign-content hardening, CSS style allowlists, selector limits used by transform hooks, and unsafe-input reporting.

#
SanitizationPolicy::collected_security_errors

source

Return a copy of unsafe findings accumulated in Collect mode.

#
SanitizationPolicy::has_url_rule

source
fn SanitizationPolicy::has_url_rule(self : SanitizationPolicy, tag_name : String, attr_name : String) -> Bool

Return whether this policy has an exact URL rule for a tag and attribute.

tag_name and attr_name should be normalized lowercase names. The default URL handling is not considered a rule; this checks only explicit tag/attribute bindings.

#
SanitizationPolicy::new

source
fn SanitizationPolicy::new(allowed_tags : Array[String], allowed_attributes? : Map[String, Array[String]], url_policy? : UrlPolicy, drop_comments? : Bool, drop_doctype? : Bool, drop_foreign_namespaces? : Bool, drop_content_tags? : Array[String], disallowed_tag_handling? : DisallowedTagHandling, force_link_rel? : Array[String], allowed_css_properties? : Array[String], strip_invisible_unicode? : Bool, selector_limits? : 
SelectorLimits, unsafe_handling? : UnsafeHandling) -> SanitizationPolicy

Construct a DOM sanitization policy.

Tag and attribute names are normalized to lowercase. By default comments, doctypes, foreign namespaces, script/style content, and invisible Unicode controls are removed. Unsafe findings are stripped unless unsafe_handling is set to Raise or Collect.

#
SanitizationPolicy::reset_collected_security_errors

source
fn SanitizationPolicy::reset_collected_security_errors(self : SanitizationPolicy) -> Unit

Clear unsafe findings accumulated in Collect mode.

#
SanitizationPolicy::sanitize_attribute_value

source
fn SanitizationPolicy::sanitize_attribute_value(self : SanitizationPolicy, tag_name : String, attr_name : String, value : String, effectively_foreign? : Bool) -> String?

Sanitize a single attribute value with this policy.

tag_name and attr_name should already be normalized to lowercase. URL attributes, URL lists, foreign SVG-like URL function attributes, and inline style values are validated through the policy. Returns None when the attribute value should be dropped.

#
SanitizationPolicy::sanitize_inline_style_value

source
fn SanitizationPolicy::sanitize_inline_style_value(self : SanitizationPolicy, tag_name : String, value : String) -> String?

Sanitize the value of an inline style attribute.

Only declarations whose property names are in allowed_css_properties are kept. Declarations that may load external resources are kept only when their url(...) values pass the policy's URL rules. Returns None when no safe declaration remains.

#
SanitizationPolicy::selector_limits

source

Return the selector limits used by this policy.

Sanitizer transforms use these limits when selector-based hooks are evaluated during sanitization.

#
SanitizationPolicy::with_extra_allowed_tags

source
fn SanitizationPolicy::with_extra_allowed_tags(self : SanitizationPolicy, extra_tags : Array[String]) -> SanitizationPolicy

Return a copy of this policy with additional allowed tag names.

Extra tags are trimmed, ASCII-lowercased, deduplicated, and merged with the existing allowlist. Other policy settings, including URL rules and unsafe handling, are preserved.

#
SanitizeTransformObserver

source
pub struct SanitizeTransformObserver {
  // private fields
}

Observer callbacks for sanitizer-driven DOM rewrites.

The node hook runs for events that have an associated DOM node. The report callback receives every sanitizer event message and the optional related node, including unsafe input that was stripped or collected.

#
SanitizeTransformObserver::new

source

Construct sanitizer observer callbacks.

Pass None for either callback to observe only reports or only affected nodes. Both callbacks are best-effort notifications; they do not change the sanitizer decision.

#
UnsafeHandling

source
pub(all) enum UnsafeHandling {
  Strip
  Raise
  Collect
} derive(Eq, 
Debug)

How sanitizer reports unsafe input that it strips or rewrites.

#
UrlFilter

source
pub struct UrlFilter {
  // private fields
}

Callback wrapper used to rewrite or reject URL values before validation.

The callback receives normalized tag name, normalized attribute name, and the raw attribute value. Returning None drops the URL.
impl Debug for UrlFilter

#
UrlFilter::new

source
fn UrlFilter::new(callback : (String, String, String) -> String?) -> UrlFilter

Construct a URL filter from a callback.

#
UrlHandling

source
pub(all) enum UrlHandling {
  UrlAllow
  UrlStrip
  UrlProxy
} derive(Eq, 
Debug)

Action used after a URL value passes the configured URL checks.

#
UrlPolicy

source
pub struct UrlPolicy {
  // private fields
} derive(
Debug)

URL sanitization policy shared by URL-bearing attributes.

Exact (tag, attr) rules take precedence. Unmatched URL-like attributes use the default handling and relative-URL behavior.

#
UrlPolicy::new

source
fn UrlPolicy::new(default_handling? : UrlHandling, default_allow_relative? : Bool, allow_rules? : Array[UrlPolicyRule], proxy? : UrlProxy, url_filter? : UrlFilter) -> UrlPolicy

Construct a URL policy.

allow_rules are exact tag/attribute bindings. url_filter runs before rule validation and can rewrite or drop the URL value.

#
UrlPolicyRule

source
pub struct UrlPolicyRule {
  // private fields
} derive(
Debug)

URL rule bound to a tag and attribute name.

#
UrlPolicyRule::new

source
fn UrlPolicyRule::new(tag : StringView, attr : StringView, rule : UrlRule) -> UrlPolicyRule

Construct a URL policy rule for one tag and attribute.

#
UrlProxy

source
pub struct UrlProxy {
  // private fields
} derive(
Debug)

Proxy endpoint used when a URL rule selects UrlProxy.

Sanitized URLs are emitted as url?param=<encoded-url> or url&param=<encoded-url> depending on whether the proxy URL already has a query string.

#
UrlProxy::new

source
fn UrlProxy::new(url : StringView, param? : String) -> UrlProxy

Construct a URL proxy descriptor.

#
UrlRule

source
pub struct UrlRule {
  // private fields
} derive(
Debug)

Per-attribute URL validation rule.

Rules can restrict schemes and hosts, disallow fragments, normalize protocol-relative URLs, override relative-URL handling, or route accepted URLs through a proxy.

#
UrlRule::new

source
fn UrlRule::new(allowed_schemes? : Array[String], allowed_hosts? : Array[String], allow_fragment? : Bool, resolve_protocol_relative? : String?, handling? : UrlHandling, allow_relative? : Bool, proxy? : UrlProxy) -> UrlRule

Construct a per-attribute URL validation rule.

Schemes and hosts are normalized to lowercase. resolve_protocol_relative rewrites protocol-relative URLs such as //example.com before validation.

#
css_preset_text

source
fn css_preset_text() -> Array[String]

Return the conservative text-style CSS property allowlist.

#
css_value_may_load_external_resource

source
fn css_value_may_load_external_resource(value : StringView) -> Bool

Conservatively detect CSS values that can load external resources.

This returns true for imports, url(...), image-set-like functions, legacy browser extension hooks, and values that cannot be normalized safely because of escapes or malformed comments. It is a prefilter; URL-bearing declarations still need URL-policy validation before they are kept.

#
default_document_sanitization_policy

source
fn default_document_sanitization_policy() -> SanitizationPolicy

Return the default document sanitizer policy.

This extends the fragment policy with document shell tags and preserves the doctype.

#
default_sanitization_policy

source
fn default_sanitization_policy() -> SanitizationPolicy

Return the default fragment sanitizer policy.

#
escaped_end_tag_for

source
fn escaped_end_tag_for(node : 
Node) -> String?

Return the literal closing tag used when escaping a node as text.

Void elements do not get an end tag. Other elements return </name> using the node's current tag name.

#
is_foreign_url_function_like_attr

source
fn is_foreign_url_function_like_attr(name : String) -> Bool

Return whether a foreign-content attribute can load URLs through CSS syntax.

These SVG-style presentation attributes are checked for resource-loading CSS functions when the node is effectively foreign.

#
is_single_url_like_attr

source
fn is_single_url_like_attr(name : String) -> Bool

Return whether name is a single URL-bearing HTML attribute.

Inputs should be normalized lowercase attribute names.

#
is_space_separated_url_list_attr

source
fn is_space_separated_url_list_attr(name : String) -> Bool

Return whether name carries a space-separated URL list.

Inputs should be normalized lowercase attribute names.

#
is_srcset_like_attr

source
fn is_srcset_like_attr(name : String) -> Bool

Return whether name carries a comma-separated image candidate URL list.

Inputs should be normalized lowercase attribute names.

#
node_is_effectively_foreign

source
fn node_is_effectively_foreign(node : 
Node) -> Bool

Return whether a node is treated as foreign-content for sanitization.

A node is effectively foreign when it or an ancestor has a non-HTML namespace, or when it appears under an svg or math element name. This is used to harden URL-bearing attributes and active foreign-content elements.

#
push_html_whitespace_tokens

source
fn push_html_whitespace_tokens(tokens : Array[String], value : StringView) -> Unit

Split HTML whitespace-separated tokens into a unique normalized list.

Tokens are trimmed, ASCII-lowercased, and appended to tokens only when non-empty and not already present. Existing token order is preserved.

#
push_unique_string

source
fn push_unique_string(values : Array[String], value : String) -> Unit

Append value to values if it is non-empty and absent.

Existing order is preserved, making this suitable for normalized allowlists and token merges where duplicate entries should be ignored.

#
remove_child_at

source
fn remove_child_at(parent : 
Node, index : Int) -> Unit

Remove one child from parent and detach its parent pointer.

index must be a valid child index. The removed node's parent field is cleared only when it still points at parent.

#
sanitize_dom

source

Sanitize a DOM node in place and return the sanitized root.

When no policy is supplied, document roots use the document policy and other roots use the fragment policy.

#
sanitize_dom_with_observer

source

Sanitize a DOM node in place with optional observer callbacks.

When policy is None, document roots use the document policy and other roots use the fragment policy. The observer is notified about sanitizer rewrites and unsafe input reports. Non-document/non-fragment roots are sanitized through a temporary fragment wrapper; the returned node may therefore be the original node or a fragment containing surviving nodes.

#
unwrap_child_at

source
fn unwrap_child_at(parent : 
Node, index : Int) -> Int

Replace one child with its own children.

The child at index is removed, detached from parent, and its children are inserted into parent at the same position with updated parent pointers. Returns the number of inserted children.

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io