nsIParserUtils

Implemented by: @mozilla.org/parserutils;1 as a service:

var parserUtils = Components.classes["@mozilla.org/parserutils;1"]
                  .getService(Components.interfaces.nsIParserUtils);

Method overview

Constants

Methods

convertToPlainText()

Converts HTML to plain text.

AString convertToPlainText(
  in AString src,
  in unsigned long flags,
  in unsigned long wrapCol
);

Parameters

src

The HTML source to parse (C++ callers are allowed but not required to use the same string for the return value.)

flags

Conversion option flags defined in nsIDocumentEncoder.

wrapCol

Number of characters per line; 0 for no auto-wrapping.

Return value

The plain text conversion of the HTML specified in src.

parseFragment()

Parses markup into a sanitized document fragment.

nsIDOMDocumentFragment parseFragment(
  in AString fragment,
  in unsigned long flags,
  in boolean isXML,
  in nsIURI baseURI,
  in nsIDOMElement element
);

Parameters

fragment

The input markup.

flags

Sanitization option flags defined above.

isXML

true if |fragment| is XML and false if HTML.

baseURI

The base URL for this fragment.

element

The context node for the fragment parsing algorithm.

Return value

An nsIDOMDocumentFragment object for the resulting sanitized document fragment.

sanitize()

Parses a string into an HTML document, sanitizes the document, and returns the result serialized to a string.

The sanitizer is designed to protect against XSS when sanitized content is inserted into a different-origin context without an iframe-equivalent sandboxing mechanism.

By default, the sanitizer doesn't try to avoid leaking information that the content was viewed to third parties. That is, by default, for example <img> with a source pointing to an HTTP server potentially controlled by a third party is not removed. To avoid ambient information leakage upon loading the sanitized content, use the SanitizerInternalEmbedsOnly flag. In that case, <a> links (and similar) to other content are preserved, so an explicit user action (following a link) after the content has been loaded can still leak information.

By default, non-dangerous non-CSS presentational HTML elements and attributes or forms are not removed. To remove these, use SanitizerDropNonCSSPresentation and/or SanitizerDropForms.

By default, comments and CSS is removed. To preserve comments, use SanitizerAllowComments. To preserve <style> elements and style attributes on other elements, use SanitizerAllowStyle. -moz-binding is removed from <style> elements and style attributes if present. In this case, properties that Gecko doesn't recognize can get removed as a side effect.

AString sanitize(
  in AString src,
  in unsigned long flags
);

Parameters

src

The HTML source to parse (C++ callers are allowed but not required to use the same string for the return value).

flags

Sanitization option flags defined above.

Return value

The resulting text.