robinpath_modules/modules/

sanitize_mod.rs

use robinpath::{RobinPath, Value};

pub fn register(rp: &mut RobinPath) {
    rp.register_builtin("sanitize.html", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let mode = args.get(1).map(|v| v.to_display_string()).unwrap_or_else(|| "strip".to_string());
        match mode.as_str() {
            "escape" => Ok(Value::String(escape_html(&s))),
            _ => Ok(Value::String(strip_tags(&s, &[]))),
        }
    });

    rp.register_builtin("sanitize.xss", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let re = regex::Regex::new(r"(?i)<script[^>]*>[\s\S]*?</script>|javascript:|on\w+\s*=").unwrap();
        let cleaned = re.replace_all(&s, "").to_string();
        Ok(Value::String(strip_tags(&cleaned, &[])))
    });

    rp.register_builtin("sanitize.sql", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let escaped = s
            .replace('\'', "''")
            .replace('\\', "\\\\")
            .replace('\0', "")
            .replace('\n', "\\n")
            .replace('\r', "\\r");
        Ok(Value::String(escaped))
    });

    rp.register_builtin("sanitize.regex", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        Ok(Value::String(regex::escape(&s)))
    });

    rp.register_builtin("sanitize.filename", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let replacement = args.get(1).map(|v| v.to_display_string()).unwrap_or_else(|| "_".to_string());
        let re = regex::Regex::new(r#"[<>:"/\\|?*\x00-\x1f]"#).unwrap();
        let cleaned = re.replace_all(&s, replacement.as_str()).to_string();
        Ok(Value::String(cleaned))
    });

    rp.register_builtin("sanitize.path", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let cleaned = s.replace("..", "").replace('\0', "");
        Ok(Value::String(cleaned))
    });

    rp.register_builtin("sanitize.url", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let re = regex::Regex::new(r"(?i)^(javascript|data|vbscript):").unwrap();
        if re.is_match(&s) {
            Ok(Value::String(String::new()))
        } else {
            Ok(Value::String(s))
        }
    });

    rp.register_builtin("sanitize.email", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        Ok(Value::String(s.trim().to_lowercase()))
    });

    rp.register_builtin("sanitize.stripTags", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let allowed = args.get(1).map(|v| v.to_display_string()).unwrap_or_default();
        let allowed_tags: Vec<&str> = allowed.split(',').map(|t| t.trim()).filter(|t| !t.is_empty()).collect();
        Ok(Value::String(strip_tags(&s, &allowed_tags)))
    });

    rp.register_builtin("sanitize.escapeHtml", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        Ok(Value::String(escape_html(&s)))
    });

    rp.register_builtin("sanitize.unescapeHtml", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        Ok(Value::String(unescape_html(&s)))
    });

    rp.register_builtin("sanitize.trim", |args, _| {
        let val = args.first().cloned().unwrap_or(Value::Null);
        Ok(deep_trim(&val))
    });

    rp.register_builtin("sanitize.truncate", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let max_len = args.get(1).map(|v| v.to_number() as usize).unwrap_or(100);
        let suffix = args.get(2).map(|v| v.to_display_string()).unwrap_or_else(|| "...".to_string());
        if s.len() <= max_len {
            Ok(Value::String(s))
        } else {
            let end = max_len.saturating_sub(suffix.len()).min(s.len());
            Ok(Value::String(format!("{}{}", &s[..end], suffix)))
        }
    });

    rp.register_builtin("sanitize.alphanumeric", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let allow_spaces = args.get(1).map(|v| v.is_truthy()).unwrap_or(false);
        let result: String = s.chars().filter(|c| c.is_alphanumeric() || (allow_spaces && *c == ' ')).collect();
        Ok(Value::String(result))
    });

    rp.register_builtin("sanitize.slug", |args, _| {
        let s = args.first().map(|v| v.to_display_string()).unwrap_or_default();
        let sep = args.get(1).map(|v| v.to_display_string()).unwrap_or_else(|| "-".to_string());
        let slug: String = s
            .to_lowercase()
            .chars()
            .map(|c| if c.is_alphanumeric() || c == ' ' { c } else { ' ' })
            .collect::<String>()
            .split_whitespace()
            .collect::<Vec<_>>()
            .join(&sep);
        Ok(Value::String(slug))
    });
}

fn escape_html(s: &str) -> String {
    s.replace('&', "&amp;")
        .replace('<', "&lt;")
        .replace('>', "&gt;")
        .replace('"', "&quot;")
        .replace('\'', "&#39;")
}

fn unescape_html(s: &str) -> String {
    s.replace("&amp;", "&")
        .replace("&lt;", "<")
        .replace("&gt;", ">")
        .replace("&quot;", "\"")
        .replace("&#39;", "'")
}

fn strip_tags(s: &str, _allowed: &[&str]) -> String {
    let re = regex::Regex::new(r"<[^>]*>").unwrap();
    re.replace_all(s, "").to_string()
}

fn deep_trim(val: &Value) -> Value {
    match val {
        Value::String(s) => Value::String(s.trim().to_string()),
        Value::Array(arr) => Value::Array(arr.iter().map(deep_trim).collect()),
        Value::Object(obj) => {
            let trimmed: indexmap::IndexMap<String, Value> = obj
                .iter()
                .map(|(k, v)| (k.clone(), deep_trim(v)))
                .collect();
            Value::Object(trimmed)
        }
        _ => val.clone(),
    }
}