sanitize-html招募

// 示例：配置结构体定义 (仓颉语言风格伪代码)
SanitizeConfig ::= struct {
    // 允许的HTML标签列表
    allowed_tags: []string = ["p", "strong", "em", "a", "ul", "ol", "li", "br"],

    // 按标签名组织的允许属性列表，支持通配符
    allowed_attrs: map[string][]string = {
        "a": ["href", "title", "target"],
        "p": ["class"],
        // 允许所有标签拥有 'data-' 开头的自定义属性
        "*": ["data-*"]
    },

    // 允许的URL协议
    allowed_schemes: []string = ["http", "https", "mailto", "tel"],

    // 允许的iframe宿主域名
    allowed_iframe_hosts: []string = ["www.youtube.com", "player.vimeo.com"],

    // 处理非白名单标签的模式：丢弃、转义或递归转义
    disallowed_tags_mode: DisallowedMode = .Discard,
}

// 示例：核心净化算法伪代码
func sanitize_html(html: string, config: SanitizeConfig) -> string {
    dom_tree = parse_html(html) // 解析为AST
    
    traverse_tree(dom_tree, func (node) {
        if node.type == .Element {
            // 1. 检查标签是否允许
            if !is_tag_allowed(node.name, config.allowed_tags) {
                handle_disallowed_tag(node, config.disallowed_tags_mode)
                return
            }
            
            // 2. 检查并过滤属性
            for attr in node.attributes.copy() {
                if !is_attribute_allowed(node.name, attr.name, config.allowed_attrs) {
                    node.attributes.remove(attr.name)
                    continue
                }
                
                // 3. 特殊属性（href, src）的URL验证
                if attr.name in ["href", "src", "cite"] {
                    if !is_url_safe(attr.value, config.allowed_schemes, config.allowed_iframe_hosts) {
                        node.attributes.remove(attr.name)
                    }
                }
                
                // 4. 过滤style属性
                if attr.name == "style" {
                    node.attributes["style"] = sanitize_css(attr.value)
                }
            }
        }
        
        // 递归处理子节点
        for child in node.children {
            traverse_tree(child)
        }
    })
    
    return serialize_tree(dom_tree)
}