Sanitize HTML

use sanitize.qweruse sanitize_html, sanitize_html_only from sanitize      // Quillo 0.6: only these

ammonia = "4"

// A comment written in HTML, shown safely.////   quillo run sanitize.qwe      then open http://localhost:8080/use "sanitize.qwer"let comment = `<p onclick="steal()">Nice post! <b>Bold</b> <a href="javascript:alert(1)">click</a><a href="https://quillolang.org">Quillo</a><script>alert("x")</script><img src=x onerror="steal()"></p>`route GET / = <html><body>    <h1>Comments</h1>    <div>{raw(sanitize_html(comment))}</div>    <div>{raw(sanitize_html_only(comment, ["b", "a"]))}</div>    <p>{strip_tags(comment)}</p></body></html>

//! HTML from users made safe to show: scripts, event handlers and dangerous links removed, formatting kept.//! version: 1.0.0//!//! [dependencies]//! ammonia = "4"use std::collections::HashSet;/// `html` with only safe tags and attributes left (links, lists, tables, images, emphasis); links get `rel="noopener noreferrer"`.pub fn sanitize_html(html: &str) -> String {    ammonia::clean(html)}/// `html` with only the `tags` named left, and none of their attributes but `href` on links.pub fn sanitize_html_only(html: &str, tags: Vec<String>) -> String {    let set: HashSet<&str> = tags.iter().map(|t| t.as_str()).collect();    let mut b = ammonia::Builder::empty();    b.tags(set);    if tags.iter().any(|t| t == "a") {        b.add_tag_attributes("a", &["href"]).link_rel(Some("noopener noreferrer nofollow")).url_schemes(["http", "https", "mailto"].into());    }    b.clean(html).to_string()}/// The text of `html`, every tag taken out (the text stays escaped, ready for a page).pub fn strip_tags(html: &str) -> String {    ammonia::Builder::empty().clean(html).to_string()}