@ordojs/security/dist/xss/template-escaper.d.ts

Security package for OrdoJS with XSS, CSRF, and injection protection

/**
 * Escape special HTML characters to prevent XSS attacks in template interpolations
 */
/**
 * Escape HTML special characters to prevent XSS attacks
 * @param value String value to escape
 * @returns Escaped HTML string
 */
export declare function escapeHtml(value: string): string;
/**
 * Options for the template escaper
 */
export interface TemplateEscaperOptions {
    /**
     * Whether to escape all interpolated values by default
     * @default true
     */
    escapeByDefault: boolean;
    /**
     * Whether to allow raw HTML through the raw tag function
     * @default false
     */
    allowRawHtml: boolean;
}
/**
 * Template escaper for automatic HTML escaping in template interpolations
 */
export declare class TemplateEscaper {
    private options;
    /**
     * Create a new TemplateEscaper instance
     * @param options Template escaper options
     */
    constructor(options?: Partial<TemplateEscaperOptions>);
    /**
     * Escape a value for safe HTML interpolation
     * @param value Value to escape
     * @returns Escaped value
     */
    escape(value: unknown): string;
    /**
     * Create a tagged template function that automatically escapes interpolated values
     * @returns Tagged template function
     */
    createEscapedTemplate(): (strings: TemplateStringsArray, ...values: unknown[]) => string;
    /**
     * Create a tagged template function that allows raw HTML (use with caution)
     * @returns Tagged template function for raw HTML
     * @throws Error if raw HTML is not allowed in options
     */
    createRawTemplate(): (strings: TemplateStringsArray, ...values: unknown[]) => string;
}
/**
 * Default template escaper instance
 */
export declare const defaultTemplateEscaper: TemplateEscaper;
/**
 * Tagged template function that automatically escapes interpolated values
 * @example html\`<div>\${userInput}</div>\` // userInput is automatically escaped
 */
export declare const html: (strings: TemplateStringsArray, ...values: unknown[]) => string;
/**
 * Create a raw HTML tagged template (use with caution)
 * Must be explicitly enabled by setting allowRawHtml: true
 */
export declare function createRawHtmlTemplate(): (strings: TemplateStringsArray, ...values: unknown[]) => string;
//# sourceMappingURL=template-escaper.d.ts.map