Documentation
¶
Overview ¶
Package sanitize provides safe-by-default sanitizers for untrusted input.
Index ¶
- Variables
- type FilenameOption
- type FilenameSanitizer
- type HTMLOption
- type HTMLPolicy
- type HTMLPolicyFunc
- type HTMLSanitizeMode
- type HTMLSanitizer
- type MarkdownOption
- type MarkdownSanitizer
- type NoSQLDetectOption
- type NoSQLInjectionDetector
- type SQLDetectOption
- type SQLInjectionDetector
- type SQLMode
- type SQLOption
- type SQLSanitizer
Constants ¶
This section is empty.
Variables ¶
var ( // ErrInvalidHTMLConfig indicates an invalid HTML sanitizer configuration. ErrInvalidHTMLConfig = ewrap.New("invalid html sanitize config") // ErrInvalidMarkdownConfig indicates an invalid Markdown sanitizer configuration. ErrInvalidMarkdownConfig = ewrap.New("invalid markdown sanitize config") // ErrInvalidSQLConfig indicates an invalid SQL sanitizer configuration. ErrInvalidSQLConfig = ewrap.New("invalid sql sanitize config") // ErrInvalidNoSQLConfig indicates an invalid NoSQL detector configuration. ErrInvalidNoSQLConfig = ewrap.New("invalid nosql detector config") // ErrInvalidFilenameConfig indicates an invalid filename sanitizer configuration. ErrInvalidFilenameConfig = ewrap.New("invalid filename sanitize config") // ErrHTMLTooLong indicates the HTML input exceeds the configured limit. ErrHTMLTooLong = ewrap.New("html input too long") // ErrHTMLInvalid indicates the HTML input could not be parsed safely. ErrHTMLInvalid = ewrap.New("html input invalid") // ErrMarkdownTooLong indicates the Markdown input exceeds the configured limit. ErrMarkdownTooLong = ewrap.New("markdown input too long") // ErrSQLInputTooLong indicates the SQL input exceeds the configured limit. ErrSQLInputTooLong = ewrap.New("sql input too long") // ErrSQLIdentifierInvalid indicates the SQL identifier is invalid. ErrSQLIdentifierInvalid = ewrap.New("sql identifier invalid") // ErrSQLLiteralInvalid indicates the SQL literal is invalid. ErrSQLLiteralInvalid = ewrap.New("sql literal invalid") // ErrSQLLikeEscapeInvalid indicates the SQL LIKE escape character is invalid. ErrSQLLikeEscapeInvalid = ewrap.New("sql like escape invalid") // ErrSQLInjectionDetected indicates the input matched SQL injection heuristics. ErrSQLInjectionDetected = ewrap.New("sql injection detected") // ErrNoSQLInputTooLong indicates the NoSQL input exceeds the configured limit. ErrNoSQLInputTooLong = ewrap.New("nosql input too long") // ErrNoSQLInjectionDetected indicates the input matched NoSQL injection heuristics. ErrNoSQLInjectionDetected = ewrap.New("nosql injection detected") // ErrFilenameEmpty indicates the filename is empty after sanitization. ErrFilenameEmpty = ewrap.New("filename empty") // ErrFilenameTooLong indicates the filename exceeds the configured limit. ErrFilenameTooLong = ewrap.New("filename too long") // ErrFilenameInvalid indicates the filename contains invalid characters. ErrFilenameInvalid = ewrap.New("filename invalid") )
Functions ¶
This section is empty.
Types ¶
type FilenameOption ¶
type FilenameOption func(*filenameOptions) error
FilenameOption configures filename sanitization.
func WithFilenameAllowLeadingDot ¶
func WithFilenameAllowLeadingDot(allow bool) FilenameOption
WithFilenameAllowLeadingDot allows filenames starting with a dot.
func WithFilenameAllowSpaces ¶
func WithFilenameAllowSpaces(allow bool) FilenameOption
WithFilenameAllowSpaces allows spaces in filenames.
func WithFilenameAllowUnicode ¶
func WithFilenameAllowUnicode(allow bool) FilenameOption
WithFilenameAllowUnicode allows Unicode characters in filenames.
func WithFilenameMaxLength ¶
func WithFilenameMaxLength(maxLength int) FilenameOption
WithFilenameMaxLength sets the maximum accepted filename length.
func WithFilenameReplacement ¶
func WithFilenameReplacement(replacement rune) FilenameOption
WithFilenameReplacement sets the replacement rune for invalid characters.
type FilenameSanitizer ¶
type FilenameSanitizer struct {
// contains filtered or unexported fields
}
FilenameSanitizer sanitizes a single filename or path segment.
func NewFilenameSanitizer ¶
func NewFilenameSanitizer(opts ...FilenameOption) (*FilenameSanitizer, error)
NewFilenameSanitizer constructs a filename sanitizer with options.
type HTMLOption ¶
type HTMLOption func(*htmlOptions) error
HTMLOption configures the HTML sanitizer.
func WithHTMLMaxLength ¶
func WithHTMLMaxLength(maxLength int) HTMLOption
WithHTMLMaxLength sets the maximum accepted HTML input length.
func WithHTMLMode ¶
func WithHTMLMode(mode HTMLSanitizeMode) HTMLOption
WithHTMLMode sets the HTML sanitization mode.
func WithHTMLPolicy ¶
func WithHTMLPolicy(policy HTMLPolicy) HTMLOption
WithHTMLPolicy sets a custom HTML policy.
type HTMLPolicy ¶
HTMLPolicy defines a custom HTML sanitizer.
type HTMLPolicyFunc ¶
HTMLPolicyFunc adapts a function to HTMLPolicy.
type HTMLSanitizeMode ¶
type HTMLSanitizeMode int
HTMLSanitizeMode describes how HTML is sanitized.
const ( // HTMLSanitizeEscape escapes HTML tags and entities. HTMLSanitizeEscape HTMLSanitizeMode = iota // HTMLSanitizeStrip removes HTML tags and returns plain text. HTMLSanitizeStrip )
type HTMLSanitizer ¶
type HTMLSanitizer struct {
// contains filtered or unexported fields
}
HTMLSanitizer sanitizes HTML input with safe defaults.
func NewHTMLSanitizer ¶
func NewHTMLSanitizer(opts ...HTMLOption) (*HTMLSanitizer, error)
NewHTMLSanitizer constructs an HTML sanitizer with options.
type MarkdownOption ¶
type MarkdownOption func(*markdownOptions) error
MarkdownOption configures the Markdown sanitizer.
func WithMarkdownAllowRawHTML ¶
func WithMarkdownAllowRawHTML(allow bool) MarkdownOption
WithMarkdownAllowRawHTML allows raw HTML inside Markdown.
func WithMarkdownMaxLength ¶
func WithMarkdownMaxLength(maxLength int) MarkdownOption
WithMarkdownMaxLength sets the maximum accepted Markdown input length.
type MarkdownSanitizer ¶
type MarkdownSanitizer struct {
// contains filtered or unexported fields
}
MarkdownSanitizer sanitizes Markdown input with safe defaults.
func NewMarkdownSanitizer ¶
func NewMarkdownSanitizer(opts ...MarkdownOption) (*MarkdownSanitizer, error)
NewMarkdownSanitizer constructs a Markdown sanitizer with options.
type NoSQLDetectOption ¶
type NoSQLDetectOption func(*nosqlDetectOptions) error
NoSQLDetectOption configures the NoSQL injection detector.
func WithNoSQLDetectMaxLength ¶
func WithNoSQLDetectMaxLength(maxLength int) NoSQLDetectOption
WithNoSQLDetectMaxLength sets the maximum input length for detection.
func WithNoSQLDetectOperators ¶
func WithNoSQLDetectOperators(operators ...string) NoSQLDetectOption
WithNoSQLDetectOperators replaces the default operator list.
type NoSQLInjectionDetector ¶
type NoSQLInjectionDetector struct {
// contains filtered or unexported fields
}
NoSQLInjectionDetector checks inputs for NoSQL injection heuristics.
func NewNoSQLInjectionDetector ¶
func NewNoSQLInjectionDetector(opts ...NoSQLDetectOption) (*NoSQLInjectionDetector, error)
NewNoSQLInjectionDetector constructs a detector with safe defaults.
func (*NoSQLInjectionDetector) Detect ¶
func (d *NoSQLInjectionDetector) Detect(input string) error
Detect returns ErrNoSQLInjectionDetected when a pattern matches.
type SQLDetectOption ¶
type SQLDetectOption func(*sqlDetectOptions) error
SQLDetectOption configures the SQL injection detector.
func WithSQLDetectMaxLength ¶
func WithSQLDetectMaxLength(maxLength int) SQLDetectOption
WithSQLDetectMaxLength sets the maximum input length for detection.
func WithSQLDetectPatterns ¶
func WithSQLDetectPatterns(patterns ...string) SQLDetectOption
WithSQLDetectPatterns replaces the default detection patterns.
type SQLInjectionDetector ¶
type SQLInjectionDetector struct {
// contains filtered or unexported fields
}
SQLInjectionDetector checks inputs for SQL injection heuristics.
func NewSQLInjectionDetector ¶
func NewSQLInjectionDetector(opts ...SQLDetectOption) (*SQLInjectionDetector, error)
NewSQLInjectionDetector constructs a detector with safe defaults.
func (*SQLInjectionDetector) Detect ¶
func (d *SQLInjectionDetector) Detect(input string) error
Detect returns ErrSQLInjectionDetected when a pattern matches.
type SQLOption ¶
type SQLOption func(*sqlOptions) error
SQLOption configures the SQL sanitizer.
func WithSQLAllowQualifiedIdentifiers ¶
WithSQLAllowQualifiedIdentifiers allows dotted identifiers (schema.table).
func WithSQLLikeEscapeChar ¶
WithSQLLikeEscapeChar sets the escape character for SQL LIKE patterns.
func WithSQLMaxLength ¶
WithSQLMaxLength sets the maximum accepted SQL input length.
func WithSQLMode ¶
WithSQLMode sets the SQL sanitization mode.
type SQLSanitizer ¶
type SQLSanitizer struct {
// contains filtered or unexported fields
}
SQLSanitizer sanitizes SQL inputs with safe defaults.
func NewSQLSanitizer ¶
func NewSQLSanitizer(opts ...SQLOption) (*SQLSanitizer, error)
NewSQLSanitizer constructs a SQL sanitizer with options.
Source Files