package safehtmlutil

Import Path
	github.com/google/safehtml/internal/safehtmlutil (on go.dev)

Dependency Relation
	imports 4 packages, and imported by 2 packages

Involved Source Files Package safehtmlutil contains functions shared by package safehtml and safehtml/template.
Package-Level Functions (total 9, in which 6 are exported)
Indirect returns the value, after dereferencing as many times as necessary to reach the base type (or nil).
IsSafeTrustedResourceURLPrefix returns whether the given prefix is safe to use as a TrustedResourceURL prefix. TrustedResourceURL prefixes must start with one of the following: * `https://<origin>/` * `//<origin>/` * `/<pathStart>` * `about:blank#` `<origin>` must contain only alphanumerics, '.', ':', '[', ']', or '-'. These restrictions do not enforce a well-formed domain name, so '.' and '1.2' are valid. `<pathStart>` is any character except `/` and `\`. Based on https://url.spec.whatwg.org/commit-snapshots/56b74ce7cca8883eab62e9a12666e2fac665d03d/#url-parsing, an initial / which is not followed by another / or \ will end up in the "path state" and from there it can only go to the "fragment state" and "query state".
NormalizeURL normalizes URL content so it can be embedded in a quote-delimited string or parenthesis delimited url(...). The normalizer does not encode all HTML specials. Specifically, it does not encode '&' so correct embedding in an HTML attribute requires escaping of '&' to '&amp;'.
QueryEscapeURL produces an output that can be embedded in a URL query. The output can be embedded in an HTML attribute without further escaping.
Stringify converts its arguments to a string. It is equivalent to fmt.Sprint(args...), except that it deferences all pointers.
URLContainsDoubleDotSegment returns whether the given URL or URL substring contains the double dot-segment ".." (RFC3986 3.3) in its percent-encoded or unencoded form.
Package-Level Variables (total 4, none are exported)