CodeSnips

typescript

import { defaultSchema, type Schema } from 'hast-util-sanitize';

export const markdownSchema: Schema = {
  ...defaultSchema,
  attributes: {
    ...defaultSchema.attributes,

Safe markdown rendering (remark + rehype)

markdown security remark

by codesnips 3 tabs

ruby

class PostsController < ApplicationController
  def new
    @post = Post.new
  end

  def create

Inline markdown preview using Turbo Frames

rails hotwire turbo

by codesnips 4 tabs

typescript

import { JSDOM } from 'jsdom';
import createDOMPurify, { DOMPurifyI } from 'dompurify';

const { window } = new JSDOM('');
const DOMPurify: DOMPurifyI = createDOMPurify(window as unknown as Window);

Sanitize user HTML safely (DOMPurify + JSDOM)

security html dompurify

by codesnips 2 tabs

ruby

require "loofah"

class HtmlSanitizer
  ALLOWED_TAGS  = %w[p br a strong em ul ol li blockquote code pre h2 h3].freeze
  ALLOWED_ATTRS = %w[href title].freeze
  SAFE_SCHEMES  = %w[http https mailto].freeze

Safer HTML Sanitization Pipeline

rails security xss

by codesnips 4 tabs

javascript

const { z } = require('zod');

const signupSchema = z
  .object({
    email: z
      .string()

Reusable Zod Schema Validation Middleware for Express Signup Routes

express zod validation

by codesnips 3 tabs

javascript

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

Front-end security - XSS and CSRF prevention

security xss csrf