HtmlSanitizer class

HTML Sanitizer for preventing XSS attacks

Constructors

HtmlSanitizer()

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

containsDangerousContent(String html) → bool

Quick check — returns true if html likely contains dangerous content.

isSafeUrl(String url) → bool

Returns false for dangerous URL schemes.

sanitize(String html, {List<String>? allowedTags, List<String>? allowedAttributes, bool allowDataAttributes = false}) → String

Sanitize html by walking the parsed DOM tree.

Constants

dangerousAttributes → const List<String>

Attribute names that are always stripped

dangerousTags → const List<String>

Tags whose entire subtree is dropped (content not preserved)

defaultAllowedAttributes → const List<String>

Default allowed attributes (safe subset)

defaultAllowedTags → const List<String>

Default allowed HTML tags (safe subset)

urlBearingAttributes → const Set<String>

Attribute names whose value is interpreted as a URL by the browser / renderer. Every one must be passed through isSafeUrl so that javascript:, file:, data: SVG, etc. cannot slip through via a non-href/src channel.