html-whitelist

A wrapper around the html5lib library for sanitizing HTML.

GET requests

The url parameter can be used to refer to a page of HTML content to be sanitized. Examples:

Alternatively, the content parameter can be used to include the HTML in the GET request itself. Examples:

The json parameter will wrap the response in a JSON dictionary under the key html. Examples:

The callback=foo parameter will enable JSONP-style callbacks, suitable for use within a <script src> tag. Examples:

The mode parameter will swap in alternative sanitizers. At this time, only the default permissive-but-safe default mode, and the restrictive atwood mode (see here) are supported. Examples:

POST requests

POST requests to /whitelist can be either multipart/form-data or application/x-www-form-urlencoded encoded. If a key named content is present then the value will be sanitized. If not, the entire request body will be sanitized.

POST requests also accept the json, callback, and mode parameters.

Demonstration using POST



html
json


default
atwood

Copyright DeWitt Clinton - Source - Discuss