ExMCP.Content.Sanitizer (ex_mcp v0.9.2)

Content sanitization utilities for MCP content.

This module handles all sanitization operations including HTML escaping, script removal, and security-related content cleaning. Extracted from the original Content.Validation module.

Summary

Types

sanitization_op()

Sanitization operation

Functions

html_escape(text)

Escapes HTML entities in text content.

normalize_unicode(text)

Normalizes Unicode characters to prevent homograph attacks.

remove_metadata(content)

Removes potentially dangerous metadata from content.

sanitize(content, operations)

Sanitizes content by applying a list of sanitization operations.

sanitize_path(path)

Sanitizes file paths to prevent directory traversal.

sanitize_text(text, operations)

Sanitizes text content specifically.

strip_scripts(text)

Removes script tags and JavaScript from HTML content.

strip_sql_injection(text)

Removes SQL injection attempts from text.

Types

sanitization_op()

@type sanitization_op() ::
  :html_escape
  | :strip_scripts
  | :normalize_unicode
  | :limit_size
  | :remove_metadata
  | :compress_media
  | {:custom, function()}
  | atom()

Sanitization operation

Functions

html_escape(text)

@spec html_escape(String.t()) :: String.t()

Escapes HTML entities in text content.

normalize_unicode(text)

@spec normalize_unicode(String.t()) :: String.t()

Normalizes Unicode characters to prevent homograph attacks.

remove_metadata(content)

@spec remove_metadata(ExMCP.Content.Protocol.content()) ::
  ExMCP.Content.Protocol.content()

Removes potentially dangerous metadata from content.

sanitize(content, operations)

@spec sanitize(ExMCP.Content.Protocol.content(), [sanitization_op()]) ::
  ExMCP.Content.Protocol.content()

Sanitizes content by applying a list of sanitization operations.

Examples

safe_content = Sanitizer.sanitize(content, [
  :html_escape,
  :strip_scripts,
  {:limit_size, 1_000_000}
])

sanitize_path(path)

@spec sanitize_path(String.t()) :: String.t()

Sanitizes file paths to prevent directory traversal.

sanitize_text(text, operations)

@spec sanitize_text(String.t(), [sanitization_op()]) :: String.t()

Sanitizes text content specifically.

strip_scripts(text)

@spec strip_scripts(String.t()) :: String.t()

Removes script tags and JavaScript from HTML content.

strip_sql_injection(text)

@spec strip_sql_injection(String.t()) :: String.t()

Removes SQL injection attempts from text.