ElementorexCms.URL (ElementorexCms v0.1.0)

Sanitizes the URLs that end up in href, src and CSS url().

Only http, https, mailto and tel URLs are kept, besides relative paths (/precios, ../a, ?q=1) and anchors (#contacto). Anything with another scheme (javascript:, data:, vbscript:...) is dropped, as are URLs with control characters or whitespace, which browsers strip before parsing (so java\tscript: would otherwise slip through).

Summary

Functions

sanitize(url, opts \\ [])

Returns the URL if it is safe to use in a link, or nil.

sanitize_media(url)

Like sanitize/2, for images and media (http and https only, besides relative URLs).

video_embed(url)

Turns a YouTube or Vimeo page URL into its canonical embed URL, or nil if it is neither. Only the video id is taken from the input, so nothing else from the URL reaches the <iframe>.

Functions

sanitize(url, opts \\ [])

@spec sanitize(term(), keyword()) :: String.t() | nil

Returns the URL if it is safe to use in a link, or nil.

Options:

:schemes - allowed schemes (default ["http", "https", "mailto", "tel"])

Examples

iex> ElementorexCms.URL.sanitize("https://example.com/a?b=1")
"https://example.com/a?b=1"
iex> ElementorexCms.URL.sanitize("/precios#planes")
"/precios#planes"
iex> ElementorexCms.URL.sanitize("JavaScript:alert(1)")
nil

sanitize_media(url)

@spec sanitize_media(term()) :: String.t() | nil

Like sanitize/2, for images and media (http and https only, besides relative URLs).

video_embed(url)

@spec video_embed(term()) :: {:youtube | :vimeo, String.t()} | nil

Turns a YouTube or Vimeo page URL into its canonical embed URL, or nil if it is neither. Only the video id is taken from the input, so nothing else from the URL reaches the <iframe>.

iex> ElementorexCms.URL.video_embed("https://www.youtube.com/watch?v=dQw4w9WgXcQ")
{:youtube, "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"}
iex> ElementorexCms.URL.video_embed("https://vimeo.com/76979871")
{:vimeo, "https://player.vimeo.com/video/76979871"}