diff --git a/README.md b/README.md index fd49d19..b055e84 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ TagSoup is used to parse the HTML, and it does a good job. However TagSoup does , , -img and br tags will be output as a single self-closing tags. Other self-closing tags will be output as an open and closing pair. There are future updates to TagSoup planned to fix these cases. +img and br tags will be output as a single self-closing tags. Other self-closing tags will be output as an open and closing pair. So or converts to , and or converts to . There are future updates to TagSoup planned to fix these cases. Integration =========== diff --git a/Text/HTML/SanitizeXSS.hs b/Text/HTML/SanitizeXSS.hs index cc25601..9d7f760 100644 --- a/Text/HTML/SanitizeXSS.hs +++ b/Text/HTML/SanitizeXSS.hs @@ -1,17 +1,17 @@ -module Text.HTML.SanitizeXSS where +module Text.HTML.SanitizeXSS (sanitizeXSS) where import Text.HTML.TagSoup import Data.Set (Set(), member, fromList) -import Data.Char ( toLower, isAscii ) +import Data.Char ( toLower ) import Network.URI ( parseURIReference, URI (..), - isAllowedInURI, escapeURIString, unEscapeString, uriScheme ) -import Codec.Binary.UTF8.String ( encodeString, decodeString ) + isAllowedInURI, escapeURIString, uriScheme ) +import Codec.Binary.UTF8.String ( encodeString ) sanitizeXSS :: String -> String sanitizeXSS = renderTagsOptions renderOptions { - optMinimize = \x -> x `elem` ["br","img"] + optMinimize = \x -> x `elem` ["br","img"] -- converts to , converts to } . safeTags . parseTags where safeTags :: [Tag String] -> [Tag String] @@ -44,13 +44,6 @@ sanitaryURI u = escapeURI :: String -> String escapeURI = escapeURIString isAllowedInURI . encodeString --- | Unescape unicode and some special characters in a URI, but --- without introducing spaces. -unescapeURI :: String -> String -unescapeURI = escapeURIString (\c -> isAllowedInURI c || not (isAscii c)) . - decodeString . unEscapeString - - safeURISchemes :: Set String safeURISchemes = fromList [ "", "http:", "https:", "ftp:", "mailto:", "file:",