# `ElementorexCms.URL`
[🔗](https://github.com/rocket4ce/elementorex_cms/blob/v0.1.0/lib/elementorex_cms/url.ex#L1)

Sanitizes the URLs that end up in `href`, `src` and CSS `url()`.

Only `http`, `https`, `mailto` and `tel` URLs are kept, besides relative paths
(`/precios`, `../a`, `?q=1`) and anchors (`#contacto`). Anything with another
scheme (`javascript:`, `data:`, `vbscript:`...) is dropped, as are URLs with
control characters or whitespace, which browsers strip before parsing (so
`java\tscript:` would otherwise slip through).

# `sanitize`

```elixir
@spec sanitize(term(), keyword()) :: String.t() | nil
```

Returns the URL if it is safe to use in a link, or `nil`.

Options:

  * `:schemes` - allowed schemes (default `["http", "https", "mailto", "tel"]`)

## Examples

    iex> ElementorexCms.URL.sanitize("https://example.com/a?b=1")
    "https://example.com/a?b=1"
    iex> ElementorexCms.URL.sanitize("/precios#planes")
    "/precios#planes"
    iex> ElementorexCms.URL.sanitize("JavaScript:alert(1)")
    nil

# `sanitize_media`

```elixir
@spec sanitize_media(term()) :: String.t() | nil
```

Like `sanitize/2`, for images and media (`http` and `https` only, besides relative URLs).

# `video_embed`

```elixir
@spec video_embed(term()) :: {:youtube | :vimeo, String.t()} | nil
```

Turns a YouTube or Vimeo page URL into its canonical embed URL, or `nil` if it
is neither. Only the video id is taken from the input, so nothing else from the
URL reaches the `<iframe>`.

    iex> ElementorexCms.URL.video_embed("https://www.youtube.com/watch?v=dQw4w9WgXcQ")
    {:youtube, "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"}
    iex> ElementorexCms.URL.video_embed("https://vimeo.com/76979871")
    {:vimeo, "https://player.vimeo.com/video/76979871"}

---

*Consult [api-reference.md](api-reference.md) for complete listing*