StripJs.clean_html

You're seeing just the function clean_html, go back to StripJs module for more information.
Link to this function

clean_html(html, opts \\ [])

View Source

Specs

clean_html(String.t(), opts()) :: String.t()

Removes JS vectors from the given HTML string.

All non-tag text and tag attribute values will be HTML-escaped, except for the contents of <style> tags, which are passed through clean_css/2.

Even if the input HTML contained no JS, the output of clean_html/2 is not guaranteed to match its input byte-for-byte.

Examples:

iex> StripJs.clean_html("<button onclick=\"alert('phear');\">Click here</button>")
"<button>Click here</button>"

iex> StripJs.clean_html("<script> console.log('oh heck'); </script>")
""

iex> StripJs.clean_html("&lt;script&gt; console.log('oh heck'); &lt;/script&gt;")
"&lt;script&gt; console.log('oh heck'); &lt;/script&gt;"  ## HTML entity attack didn't work