The sanitize-html Reference Manual

3.1.1 sanitize-html/sanitize-html.asd

Source

sanitize-html.asd.

Parent Component

sanitize-html (system).

ASDF Systems

sanitize-html.

---

3.1.2 sanitize-html/src/package.lisp

Source

sanitize-html.asd.

Parent Component

sanitize-html (system).

Packages

sanitize-html.

---

3.1.3 sanitize-html/src/policies.lisp

Dependency

src/package.lisp (file).

Source

sanitize-html.asd.

Parent Component

sanitize-html (system).

Public Interface

• *default-policy* (special variable).
• *email-policy* (special variable).
• *strict-policy* (special variable).
• make-policy (function).
• policy-allowed-attributes (reader).
• (setf policy-allowed-attributes) (writer).
• policy-allowed-css-properties (reader).
• (setf policy-allowed-css-properties) (writer).
• policy-allowed-protocols (reader).
• (setf policy-allowed-protocols) (writer).
• policy-allowed-tags (reader).
• (setf policy-allowed-tags) (writer).
• policy-escape-cdata (reader).
• (setf policy-escape-cdata) (writer).
• policy-remove-comments (reader).
• (setf policy-remove-comments) (writer).

Internals

• attribute-allowed-p (function).
• copy-policy (function).
• get-allowed-attributes (function).
• policy (structure).
• policy-p (function).
• protocol-allowed-p (function).
• tag-allowed-p (function).

---

3.1.4 sanitize-html/src/sanitizer.lisp

Dependency

src/policies.lisp (file).

Source

sanitize-html.asd.

Parent Component

sanitize-html (system).

Public Interface

• safe-url-p (function).
• sanitize (function).
• sanitize-html (function).
• sanitize-url (function).

Internals

• remove-element-keep-children (function).
• remove-event-handlers (function).
• sanitize-attributes (function).
• sanitize-css (function).
• sanitize-node (generic function).
• sanitize-style-attribute (function).
• sanitize-url-attribute (function).
• set-safe-defaults (function).

---

5.1.1 Special variables

Special Variable: *default-policy* ¶

Default sanitization policy - balanced for general content

Package

sanitize-html.

Source

src/policies.lisp.

Special Variable: *email-policy* ¶

Email policy - allows common email HTML formatting

Package

sanitize-html.

Source

src/policies.lisp.

Special Variable: *strict-policy* ¶

Strict policy - minimal allowed HTML

Package

sanitize-html.

Source

src/policies.lisp.

---

5.1.2 Ordinary functions

Function: make-policy (&key allowed-tags allowed-attributes allowed-protocols allowed-css-properties remove-comments escape-cdata) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Reader: policy-allowed-attributes (instance) ¶

Writer: (setf policy-allowed-attributes) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

allowed-attributes.

Reader: policy-allowed-css-properties (instance) ¶

Writer: (setf policy-allowed-css-properties) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

allowed-css-properties.

Reader: policy-allowed-protocols (instance) ¶

Writer: (setf policy-allowed-protocols) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

allowed-protocols.

Reader: policy-allowed-tags (instance) ¶

Writer: (setf policy-allowed-tags) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

allowed-tags.

Reader: policy-escape-cdata (instance) ¶

Writer: (setf policy-escape-cdata) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

escape-cdata.

Reader: policy-remove-comments (instance) ¶

Writer: (setf policy-remove-comments) (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Target Slot

remove-comments.

Function: safe-url-p (url &optional policy) ¶

Check if URL is safe according to POLICY

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize (html-string &optional policy) ¶

Alias for SANITIZE-HTML

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-html (html-string &optional policy) ¶

Sanitize HTML-STRING according to POLICY. Returns sanitized HTML string. This is the main entry point for HTML sanitization.

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-url (url &optional policy) ¶

Return URL if safe, nil otherwise

Package

sanitize-html.

Source

src/sanitizer.lisp.

---

5.2.1 Ordinary functions

Function: attribute-allowed-p (policy tag-name attr-name) ¶

Check if ATTR-NAME is allowed for TAG-NAME by POLICY

Package

sanitize-html.

Source

src/policies.lisp.

Function: copy-policy (instance) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Function: get-allowed-attributes (policy tag-name) ¶

Get list of allowed attributes for TAG-NAME according to POLICY

Package

sanitize-html.

Source

src/policies.lisp.

Function: policy-p (object) ¶

Package

sanitize-html.

Source

src/policies.lisp.

Function: protocol-allowed-p (policy url) ¶

Check if URL uses an allowed protocol according to POLICY

Package

sanitize-html.

Source

src/policies.lisp.

Function: remove-element-keep-children (element) ¶

Remove ELEMENT but keep its children in the same position

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: remove-event-handlers (element) ¶

Remove all event handler attributes (onclick, onload, etc.)

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-attributes (element policy) ¶

Remove disallowed attributes from ELEMENT according to POLICY

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-css (css-string allowed-properties) ¶

Sanitize CSS string, keeping only allowed properties

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-style-attribute (element policy) ¶

Sanitize inline CSS in style attribute

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: sanitize-url-attribute (element attr-name policy) ¶

Sanitize URL in attribute ATTR-NAME of ELEMENT

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: set-safe-defaults (element) ¶

Set safe default attributes on certain elements

Package

sanitize-html.

Source

src/sanitizer.lisp.

Function: tag-allowed-p (policy tag-name) ¶

Check if TAG-NAME is allowed by POLICY

Package

sanitize-html.

Source

src/policies.lisp.

---

5.2.2 Generic functions

Generic Function: sanitize-node (node policy) ¶

Sanitize a Plump DOM node according to policy

Package

sanitize-html.

Source

src/sanitizer.lisp.

Methods

Method: sanitize-node (node policy) ¶

Default case for unknown node types - remove them

Method: sanitize-node ((node cdata) policy) ¶

Handle CDATA sections based on policy

Method: sanitize-node ((node comment) policy) ¶

Remove or keep comment nodes based on policy

Method: sanitize-node ((node text-node) policy) ¶

Text nodes are always safe, no action needed

Method: sanitize-node ((node element) policy) ¶

Sanitize an HTML element node

Method: sanitize-node ((node root) policy) ¶

Sanitize all children of root node

---

5.2.3 Structures

Structure: policy ¶

Sanitization policy defining what HTML elements, attributes, and protocols are allowed

Package

sanitize-html.

Source

src/policies.lisp.

Direct superclasses

structure-object.

Direct slots

Slot: allowed-tags ¶

Type

list

Readers

policy-allowed-tags.

Writers

(setf policy-allowed-tags).

Slot: allowed-attributes ¶

Type

list

Readers

policy-allowed-attributes.

Writers

(setf policy-allowed-attributes).

Slot: allowed-protocols ¶

Type

list

Initform

(quote ("http" "https" "mailto"))

Readers

policy-allowed-protocols.

Writers

(setf policy-allowed-protocols).

Slot: allowed-css-properties ¶

Type

list

Readers

policy-allowed-css-properties.

Writers

(setf policy-allowed-css-properties).

Slot: remove-comments ¶

Type

boolean

Initform

t

Readers

policy-remove-comments.

Writers

(setf policy-remove-comments).

Slot: escape-cdata ¶

Type

boolean

Initform

t

Readers

policy-escape-cdata.

Writers

(setf policy-escape-cdata).

---