Enum HtmlRenderPolicy 

pub enum HtmlRenderPolicy {
    Escape,
    Sanitized,
    Trusted,
}

Controls how raw HTML blocks and inline HTML in markdown are rendered.

By default, raw HTML is escaped (displayed as visible text) to prevent cross-site scripting (XSS) attacks. Choose a policy based on how much you trust the markdown source:

Policy	Use when	XSS safe?
Escape	Untrusted / user-generated markdown (default)	Yes
Sanitized	User-generated markdown where you want HTML formatting but not scripts (requires sanitize feature)	Yes
Trusted	You control the markdown source entirely	No

Security

Trusted mode renders arbitrary HTML without any sanitization. If the markdown contains <script>, <iframe>, onload=, or any other active content, it will be injected into the DOM. Never use Trusted with user-generated or untrusted markdown — this is a direct XSS vector.

For user-generated content that needs HTML rendering, enable the sanitize feature and use HtmlRenderPolicy::Sanitized, which strips dangerous elements and attributes via the ammonia crate.

Variants

Escape

Escape HTML — render as visible text. Safe for all inputs.

Sanitized

Sanitize HTML with ammonia before rendering.

Strips dangerous elements (<script>, <iframe>, <object>, etc.) and event-handler attributes (onload, onclick, etc.) while preserving safe formatting tags (<b>, <i>, <a>, <code>, etc.).

Requires the sanitize Cargo feature. Falls back to Escape if the feature is not enabled.

Trusted

Render raw HTML via dangerous_inner_html without any sanitization.

Security Warning

This is a direct XSS vector. Only use this when you fully control the markdown source (e.g., static content compiled into your binary). Never use with user-generated input.

Trait Implementations

impl Clone for HtmlRenderPolicy

fn clone(&self) -> HtmlRenderPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HtmlRenderPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HtmlRenderPolicy

fn default() -> HtmlRenderPolicy

Returns the “default value” for a type.

impl Hash for HtmlRenderPolicy

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for HtmlRenderPolicy

fn eq(&self, other: &HtmlRenderPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for HtmlRenderPolicy

impl Eq for HtmlRenderPolicy

impl StructuralPartialEq for HtmlRenderPolicy