fast_sanitize v0.2.3 FastSanitize.Sanitizer.Meta
This module contains some meta-programming magic to define your own rules for scrubbers.
The StripTags scrubber is a good starting point:
defmodule FastSanitize.Sanitizer.StripTags do
require FastSanitize.Sanitizer.Meta
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments
Meta.strip_everything_not_covered
end
You can use the allow_tag_with_uri_attributes/3
and
allow_tag_with_these_attributes/2
macros to define what is allowed:
defmodule FastSanitize.Sanitizer.StripTags do
require FastSanitize.Sanitizer.Meta
alias FastSanitize.Sanitizer.Meta
Meta.strip_comments
Meta.allow_tag_with_uri_attributes "img", ["src"], ["http", "https"]
Meta.allow_tag_with_these_attributes "img", ["width", "height"]
Meta.strip_everything_not_covered
end
You can stack these if convenient:
Meta.allow_tag_with_uri_attributes "img", ["src"], ["http", "https"]
Meta.allow_tag_with_these_attributes "img", ["width", "height"]
Meta.allow_tag_with_these_attributes "img", ["title", "alt"]
Link to this section Summary
Functions
Allow the given +list+ of attributes for the specified +tag+.
Allow the given list of +values+ for the given +attribute+ on the specified +tag+.
Allow the given +list+ of attributes to contain URI information for the specified +tag+.
Allow these tags and use the regular scrub_attribute/2
function to scrub
the attributes.
Ensures any tags/attributes that are explicitly disallowed have their children dropped.
Strips all comments.
Ensures any tags/attributes not explicitly whitelisted until this statement are stripped.
Link to this section Functions
Allow the given +list+ of attributes for the specified +tag+.
Meta.allow_tag_with_these_attributes "a", ["name", "title"]
Meta.allow_tag_with_these_attributes "img", ["title", "alt"]
Allow the given list of +values+ for the given +attribute+ on the specified +tag+.
Meta.allow_tag_with_this_attribute_values "a", "target", ["_blank"]
Allow the given +list+ of attributes to contain URI information for the specified +tag+.
# Only allow SSL-enabled and mailto links
Meta.allow_tag_with_uri_attributes "a", ["href"], ["https", "mailto"]
# Only allow none-SSL images
Meta.allow_tag_with_uri_attributes "img", ["src"], ["http"]
Allow these tags and use the regular scrub_attribute/2
function to scrub
the attributes.
Ensures any tags/attributes that are explicitly disallowed have their children dropped.
Strips all comments.
Ensures any tags/attributes not explicitly whitelisted until this statement are stripped.