html

HTML as a first-class document format: parse, sanitize, serialize, and extract text. Lenient WHATWG HTML5 parsing turns real-world tag soup into an ordinary CXDM element tree, queryable with CXPath and transformable with `[?modify]` — there are no HTML-specific selectors. The sanitizer strips dangerous markup from attacker-controlled HTML via a conservative built-in policy or a customizable allowlist, the primary use being XSS-safe rendering of inbound email.

html:parse

[$html:parse] -> element — Leniently parse an HTML document into a CXDM element tree, recovering from malformed markup.

            [?lib 'cx-stdlib/html']
[?let [= $doc [$html:parse "x"]] $doc/a@href]
          
            'https://e.com'

html:parse-fragment

[$html:parse-fragment] -> [sequence element] — Parse an HTML fragment into its top-level nodes, with no implied document wrapper.

            [?lib 'cx-stdlib/html']
[$count [$html:parse-fragment "
  • a
  • b
    • "]]    
          
                2

    html:sanitize

    [$html:sanitize] -> string — Strip dangerous markup from HTML using the built-in safe-default policy, returning clean HTML.

                [?lib 'cx-stdlib/html']
[$html:sanitize "
    hi
    "]    
          
                '
    hi
    '

    html:sanitize-with-policy

    [$html:sanitize-with-policy] -> string — Sanitize HTML against a custom `[html-policy …]` allowlist layered over the safe default.

                [?lib 'cx-stdlib/html']
[$html:sanitize-with-policy "
    hi
    " [html-policy]]    
          
                '
    hi
    '

    html:sanitize-tree

    [$html:sanitize-tree] -> element — Sanitize an already-parsed element tree with the safe-default policy, returning a tree.

                [?lib 'cx-stdlib/html']
[$html:serialize [$html:sanitize-tree [$html:parse "
    hi
    "]]]    
          
                '
    hi
    '

    html:sanitize-tree-with-policy

    [$html:sanitize-tree-with-policy] -> element — Sanitize an already-parsed element tree against a custom `[html-policy …]`.

                [?lib 'cx-stdlib/html']
[$html:serialize [$html:sanitize-tree-with-policy [$html:parse "
    hi
    "] [html-policy [deny-tags img]]]]    
          
                '
    hi
    '

    html:serialize

    [$html:serialize] -> string — Serialize a CXDM element tree back to HTML5.

                [?lib 'cx-stdlib/html']
[$html:serialize [$html:sanitize-tree [$html:parse "
    hi
    "]]]    
          
                '
    hi
    '

    html:serialize-xhtml

    [$html:serialize-xhtml] -> string — Serialize a CXDM element tree to XML-well-formed XHTML (void elements self-close).

                [?lib 'cx-stdlib/html']
[$html:extract-text [$html:parse [$html:serialize-xhtml [$html:parse "
    hi
    "]]]]    
          
                'hi'

    html:extract-text

    [$html:extract-text] -> string — Strip all tags and decode entities to plain text, skipping script and style content.

                [?lib 'cx-stdlib/html']
[$html:extract-text [$html:parse "
    a
    b
  • c"]]
          
    •             'a b c'