diff --git a/README.md b/README.md
index fd49d19..b055e84 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ TagSoup is used to parse the HTML, and it does a good job. However TagSoup does
,
,
-img and br tags will be output as a single self-closing tags. Other self-closing tags will be output as an open and closing pair. There are future updates to TagSoup planned to fix these cases.
+img and br tags will be output as a single self-closing tags. Other self-closing tags will be output as an open and closing pair. So
or ![]()
converts to
, and or converts to . There are future updates to TagSoup planned to fix these cases.
Integration
===========
diff --git a/Text/HTML/SanitizeXSS.hs b/Text/HTML/SanitizeXSS.hs
index cc25601..9d7f760 100644
--- a/Text/HTML/SanitizeXSS.hs
+++ b/Text/HTML/SanitizeXSS.hs
@@ -1,17 +1,17 @@
-module Text.HTML.SanitizeXSS where
+module Text.HTML.SanitizeXSS (sanitizeXSS) where
import Text.HTML.TagSoup
import Data.Set (Set(), member, fromList)
-import Data.Char ( toLower, isAscii )
+import Data.Char ( toLower )
import Network.URI ( parseURIReference, URI (..),
- isAllowedInURI, escapeURIString, unEscapeString, uriScheme )
-import Codec.Binary.UTF8.String ( encodeString, decodeString )
+ isAllowedInURI, escapeURIString, uriScheme )
+import Codec.Binary.UTF8.String ( encodeString )
sanitizeXSS :: String -> String
sanitizeXSS = renderTagsOptions renderOptions {
- optMinimize = \x -> x `elem` ["br","img"]
+ optMinimize = \x -> x `elem` ["br","img"] -- ![]()
converts to
, converts to
} . safeTags . parseTags
where
safeTags :: [Tag String] -> [Tag String]
@@ -44,13 +44,6 @@ sanitaryURI u =
escapeURI :: String -> String
escapeURI = escapeURIString isAllowedInURI . encodeString
--- | Unescape unicode and some special characters in a URI, but
--- without introducing spaces.
-unescapeURI :: String -> String
-unescapeURI = escapeURIString (\c -> isAllowedInURI c || not (isAscii c)) .
- decodeString . unEscapeString
-
-
safeURISchemes :: Set String
safeURISchemes = fromList [ "", "http:", "https:", "ftp:", "mailto:", "file:",