Sanitizes the given unsafe, untrusted HTML fragment, and returns HTML text that is safe to add to
the DOM in a browser environment.
964992
function sanitizeHtml(unsafeHtmlInput) {
	        try {
	            var containerEl = getInertElement();
	            // Make sure unsafeHtml is actually a string (TypeScript types are not enforced at runtime).
	            var unsafeHtml = unsafeHtmlInput ? String(unsafeHtmlInput) : '';
	            // mXSS protection. Repeatedly parse the document to make sure it stabilizes, so that a browser
	            // trying to auto-correct incorrect HTML cannot cause formerly inert HTML to become dangerous.
	            var mXSSAttempts = 5;
	            var parsedHtml = unsafeHtml;
	            do {
	                if (mXSSAttempts === 0) {
	                    throw new Error('Failed to sanitize html because the input is unstable');
	                }
	                mXSSAttempts--;
	                unsafeHtml = parsedHtml;
	                DOM.setInnerHTML(containerEl, unsafeHtml);
	                if (DOM.defaultDoc().documentMode) {
	                    // strip custom-namespaced attributes on IE<=11
	                    stripCustomNsAttrs(containerEl);
	                }
	                parsedHtml = DOM.getInnerHTML(containerEl);
	            } while (unsafeHtml !== parsedHtml);
	            var sanitizer = new SanitizingHtmlSerializer();
	            var safeHtml = sanitizer.sanitizeChildren(DOM.getTemplateContent(containerEl) || containerEl);
	            // Clear out the body element.
	            var parent_1 = DOM.getTemplateContent(containerEl) || containerEl;
	            for (var _i = 0, _a = DOM.childNodesAsList(parent_1); _i < _a.length; _i++) {
	                var child = _a[_i];
	                DOM.removeChild(parent_1, child);
	            }
	            if (_angular_core.isDevMode() && sanitizer.sanitizedSomething) {
	                DOM.log('WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).');
	            }
	            return safeHtml;
	        }
	        catch (e) {
	            // In case anything goes wrong, clear out inertElement to reset the entire DOM structure.
	            inertElement = null;
	            throw e;
	        }
	    }
26535
function _sanitizeStyle(value) {
    value = String(value).trim(); // Make sure it's actually a string.
    if (!value)
        return '';
    // Single url(...) values are supported, but only for URLs that sanitize cleanly. See above for
    // reasoning behind this.
    var urlMatch = value.match(URL_RE);
    if ((urlMatch && _sanitizeUrl(urlMatch[1]) === urlMatch[1]) ||
        value.match(SAFE_STYLE_VALUE) && hasBalancedQuotes(value)) {
        return value; // Safe style values.
    }
    if (isDevMode()) {
        console.warn("WARNING: sanitizing unsafe style value " + value + " (see http://g.co/ng/security#xss).");
    }
    return 'unsafe';
}
3343
function sanitizeInput(rawInput) {
   var placeholder = HtmlService.createHtmlOutput(" ");
   placeholder.appendUntrusted(rawInput);
  
   return placeholder.getContent();
 }
125780
def markdown(text, html=False, valid_tags=GFM_TAGS):
    
    if text is None:
        return None
    if html:
        return Markup(sanitize_html(markdown_convert_html(gfm(text)), valid_tags=valid_tags))
    else:
        return Markup(markdown_convert_text(gfm(text)))
248579
def safe_escape(uri)
      uri = uri.split('#')[0] # we want to remove the fragment if present
      uri.to_s.gsub(URI_UNSAFE) { |match|
        '%' + match.unpack('H2' * match.bytesize).join('%').upcase
      }
    end
1274300
function sanitize (val) {
  if (typeof val !== 'string') {
    return '';
  }
  val = val.replace(/&/g,'&amp;');
  val = val.replace(/"/g,'&quot;');
  val = val.replace(/'/g,'&#039;');
  val = val.replace(/</g,'&lt;');
  val = val.replace(/>/g,'&gt;');
  val = val.replace(/\n/g,'<br />');
  return val ;
}
909657
function normalize (val, safe) {
    return (
      val == null ? ''
      : val === false ? ''
      : Array.isArray(val) ? val.map(normalize).join('')
      : safe === false ? $.escapeHTML(val)
      : String(val)
    )
  }
638676
public static SanitizedContent fromSafeUrlProto(SafeUrlProto url) {
    return SanitizedContent.create(SafeUrls.fromProto(url).getSafeUrlString(), ContentKind.URI);
  }
1098841
public static SanitizedContent fromTrustedResourceUrlProto(TrustedResourceUrlProto url) {
    return SanitizedContent.create(
        TrustedResourceUrls.fromProto(url).getTrustedResourceUrlString(),
        ContentKind.TRUSTED_RESOURCE_URI);
  }
1033393
public static String safeRemoveAllTags(String html) {
        html = removeNonTextTags(html);
        html = unsafeRemoveAllTags(html);
        return html;
    }
166095
public final boolean isValidEndContextForContentKind(SanitizedContentKind contentKind) {
    if (templateNestDepth != 0) {
      return false;
    }
    switch (contentKind) {
      case CSS:
        return state == HtmlContext.CSS && elType == ElementType.NONE;
      case HTML:
        return state == HtmlContext.HTML_PCDATA && elType == ElementType.NONE;
      case ATTRIBUTES:
        // Allow any html attribute context or html tag this. HTML_TAG is needed for constructs
        // like "checked" that don't require an attribute value. Explicitly disallow
        // HTML_NORMAL_ATTR_VALUE (e.g. foo={$x} without quotes) to help catch cases where
        // attributes aren't safely composable (e.g. foo={$x}checked would end up with one long
        // attribute value, whereas foo="{$x}"checked would be parsed as intended).
        return state == HtmlContext.HTML_ATTRIBUTE_NAME || state == HtmlContext.HTML_TAG;
      case JS:
        // Just ensure the state is JS -- don't worry about whether a regex is coming or not.
        return state == HtmlContext.JS && elType == ElementType.NONE;
      case URI:
        // Ensure that the URI content is non-empty and the URI type remains normal (which is
        // the assumed type of the URI content kind).
        return state == HtmlContext.URI && uriType == UriType.NORMAL && uriPart != UriPart.START;
      case TEXT:
        return state == HtmlContext.TEXT;
      case TRUSTED_RESOURCE_URI:
        // Ensure that the URI content is non-empty and the URI type remains normal (which is
        // the assumed type of the URI content kind).
        return state == HtmlContext.URI
            && uriType == UriType.TRUSTED_RESOURCE
            && uriPart != UriPart.START;
    }
    throw new IllegalArgumentException(
        "Specified content kind " + contentKind + " has no associated end context.");
  }
608653
def strip_html(html)
      return @stripped_html if @stripped_html
      allowed = @settings[:allowed_tags]
      reg = if allowed.any?
        Regexp.new(
          %(<(?!(\\s|\\/)*(#{
            allowed.map {|tag| Regexp.escape( tag )}.join( "|" )
          })( |>|\\/|'|"|<|\\s*\\z))[^>]*(>+|\\s*\\z)),
          Regexp::IGNORECASE | Regexp::MULTILINE, 'u'
        )
      else
        /<[^>]*(>+|\s*\z)/m
      end
       @stripped_html = html.gsub(reg,'')
    end
799755
function htmlParserImpl(html, handler) {
    if (html === null || html === undefined) {
      html = '';
    } else if (typeof html !== 'string') {
      html = '' + html;
    }

    var inertBodyElement = getInertBodyElement(html);
    if (!inertBodyElement) return '';

    //mXSS protection
    var mXSSAttempts = 5;
    do {
      if (mXSSAttempts === 0) {
        throw $sanitizeMinErr('uinput', 'Failed to sanitize html because the input is unstable');
      }
      mXSSAttempts--;

      // trigger mXSS if it is going to happen by reading and writing the innerHTML
      html = inertBodyElement.innerHTML;
      inertBodyElement = getInertBodyElement(html);
    } while (html !== inertBodyElement.innerHTML);

    var node = inertBodyElement.firstChild;
    while (node) {
      switch (node.nodeType) {
        case 1: // ELEMENT_NODE
          handler.start(node.nodeName.toLowerCase(), attrToMap(node.attributes));
          break;
        case 3: // TEXT NODE
          handler.chars(node.textContent);
          break;
      }

      var nextNode;
      if (!(nextNode = node.firstChild)) {
        if (node.nodeType === 1) {
          handler.end(node.nodeName.toLowerCase());
        }
        nextNode = getNonDescendant('nextSibling', node);
        if (!nextNode) {
          while (nextNode == null) {
            node = getNonDescendant('parentNode', node);
            if (node === inertBodyElement) break;
            nextNode = getNonDescendant('nextSibling', node);
            if (node.nodeType === 1) {
              handler.end(node.nodeName.toLowerCase());
            }
          }
        }
      }
      node = nextNode;
    }

    while ((node = inertBodyElement.firstChild)) {
      inertBodyElement.removeChild(node);
    }
  }
1341161
def _clean_html(html):
    
    content = html.replace(u'&#x000A;', u'\n').replace(u'¶', '')
    content = _LINK_PATTERN.sub(u'', content)
    content = _HTML_TAG_PATTERN.sub(u'', content)
    content = _BACKSLASH_PATTERN.sub(u'\n', content)
    return content
1026370
private function _sanitize_naughty_html($str): string
    {
        $evil_html_tags = \implode('|', $this->_evil_html_tags);
        $str = (string) \preg_replace_callback(
            '#<(?<start>/*\s*)(?<content>' . $evil_html_tags . ')(?<end>[^><]*)(?<rest>[><]*)#ius',
            function ($matches) {
                return $this->_sanitize_naughty_html_callback($matches);
            },
            $str
        );

        return (string) $str;
    }
176223
function sanitizeElement(element, config) {
  var sanitizer = new Sanitize(config);
  var cleaned = document.implementation.createHTMLDocument('sanitizerdoc').body;

  cleaned.appendChild(sanitizer.clean_node(element));
  return cleaned.innerHTML;
}
813364
private function sanitizeHTML($str) {
        $htmlValue=Injector::inst()->create('HTMLValue', $str);
        $santiser=Injector::inst()->create('HtmlEditorSanitiser', HtmlEditorConfig::get_active());
        $santiser->sanitise($htmlValue);
    
        return $htmlValue->getContent();
    }