EctoSanitizer v0.1.0 EctoSanitizer View Source

Provides functions for sanitizing Ecto.Changeset inputs.

Link to this section Summary

Functions

Sanitizes all changes in the given changeset that apply to field which are of the :string Ecto type

Link to this section Functions

Link to this function sanitize_all_strings(changeset, opts \\ []) View Source

Sanitizes all changes in the given changeset that apply to field which are of the :string Ecto type.

Uses the HtmlSanitizeEx.strip_tags/1 function on any change that satisfies all of the following conditions:

  1. The field associated with the change is of the type :string.
  2. The field associated with the change is not in the blacklisted_fields list of opts as defined using the :except key in opts.

Note that this function will change the value in the :changes map of an %Ecto.Changeset{} struct if the given changes are sanitized.

Examples

iex> attrs = %{string_field: "<script>Bad</script>"}
iex> result_changeset =
...>   attrs
...>   |> FakeEctoSchema.changeset()
...>   |> EctoSanitizer.sanitize_all_strings()
iex> result_changeset.changes
%{string_field: "Bad"}

Fields can be exempted from sanitization via the :except option.

iex> attrs = %{string_field: "<script>Bad</script>"}
iex> result_changeset =
...>   attrs
...>   |> FakeEctoSchema.changeset()
...>   |> EctoSanitizer.sanitize_all_strings(except: [:string_field])
iex> result_changeset.changes
%{string_field: "<script>Bad</script>"}