SANITIZE-STRING(1)

NAME
sanitize-string - Strip markup and control characters from a string

SYNOPSIS
sanitize-string [--help] [--] max_length [string]

DESCRIPTION
sanitize-string combines the functionality of strip-markup(1) and stdisplay(1) to fully sanitize an untrusted string by removing both HTML markup tags and dangerous terminal control characters (such as ANSI escape sequences). The result can be safely displayed in a terminal or used as the contents of HTML tags (but is not safe to place in HTML attributes).

If a string is provided as the second positional argument, it is used as the input. Otherwise, the string is read from standard input.

The max_length argument specifies the maximum number of characters to output. Set it to nolimit to allow arbitrarily long strings. When a limit is set, the output is truncated to that many characters.

  Sanitization order
Sanitization is performed in three steps:

1.  Strip ANSI escape sequences and control characters (via stdisplay).

2.  Strip HTML markup tags (via strip-markup).

3.  Strip ANSI escape sequences and control characters again, in case the markup stripping step decoded HTML entities into escape characters.

This ordering ensures that neither markup nor escape sequences can be used to smuggle the other past the sanitizer.

RETURN VALUES

•   0 Successfully sanitized and printed the result.

•   1 Usage error (missing or invalid arguments).

EXAMPLES
Sanitize a string with no length limit:

sanitize-string nolimit '<b>Hello</b>'

Output: Hello

Sanitize and truncate to 10 characters:

sanitize-string 10 'This is a long untrusted string.'

Output: This is a

Sanitize from standard input:

echo '<script>alert(1)</script>' | sanitize-string nolimit

Use -- to separate options from positional arguments:

sanitize-string -- nolimit '--help'

SEE ALSO
strip-markup(1), stdisplay(1)

AUTHOR
This man page has been written by Patrick Schleizer (adrelanos@whonix.org).