GeoLeaf Core API - v3.0.0
    Preparing search index...

    Variable SecurityConst

    Security: {
        escapeHtml: (str: string | null | undefined) => string;
        escapeAttribute: (str: string | null | undefined) => string;
        validateUrl: (
            url: string,
            baseUrl?: string,
            options?: ValidateUrlOptions,
        ) => string;
        validateCoordinates: (lat: number, lng: number) => [number, number];
        containsDangerousHtml: (str: unknown) => boolean;
        stripHtml: (html: string) => string;
        createSafeElement: (
            tagName: string,
            options?: SafeElementOptions,
        ) => Element;
        sanitizeSvgContent: (
            svgContent: string | null | undefined,
        ) => SVGElement | null;
        validateNumber: (
            value: unknown,
            min?: number,
            max?: number,
        ) => number | null;
        parseHtmlSafely: (html: string, allowedTags?: string[]) => DocumentFragment;
        sanitizeHTML: (
            element: Element,
            html: string | null | undefined,
            options?: SanitizeHtmlOptions,
        ) => Element | null;
        CSRFToken: CSRFTokenInternal;
    } = ...

    The GeoLeaf.Security façade — sanitisation, URL vetting and CSRF.

    ⚠️ Every DOM write that carries data from a profile or a server must pass through here. The helpers exist precisely so innerHTML is never reached for directly. This directory is the XSS/CSRF surface of the kernel: bypassing them, or reaching for innerHTML without going through them, is the one thing that is never acceptable here.

    Type Declaration

    • escapeHtml: (str: string | null | undefined) => string
    • escapeAttribute: (str: string | null | undefined) => string
    • validateUrl: (url: string, baseUrl?: string, options?: ValidateUrlOptions) => string
    • validateCoordinates: (lat: number, lng: number) => [number, number]
    • containsDangerousHtml: (str: unknown) => boolean
    • stripHtml: (html: string) => string
    • createSafeElement: (tagName: string, options?: SafeElementOptions) => Element
    • sanitizeSvgContent: (svgContent: string | null | undefined) => SVGElement | null
    • validateNumber: (value: unknown, min?: number, max?: number) => number | null
    • parseHtmlSafely: (html: string, allowedTags?: string[]) => DocumentFragment
    • sanitizeHTML: (
          element: Element,
          html: string | null | undefined,
          options?: SanitizeHtmlOptions,
      ) => Element | null
    • CSRFToken: CSRFTokenInternal

      CSRF token issuance and verification for state-changing requests.

      Holds a token per session and exposes it for outgoing requests. Verification is constant-time by construction — a comparison that short-circuits on the first differing byte leaks the token's prefix through timing.

    Settings

    Member Visibility