Type-safe wrapper for Dream.send.
val set_body : Dream.response -> node -> unitType-safe wrapper for Dream.set_body. Sets the body to the given node and sets the Content-Type header to text/html.
val write : Dream.stream -> node -> unit Dream.promiseType-safe wrapper for Dream.write.
type 'a to_attr = 'a -> attrAttributes can be created from typed values.
type 'a string_attr = ('a, unit, string, attr) Stdlib.format4 -> 'aSpecial handling for string-value attributes so they can use format strings i.e. string interpolation.
A 'void element': https://developer.mozilla.org/en-US/docs/Glossary/Void_element with no children.
Tags which can have attributes but can contain only text. The text can be formatted.
val attr : string -> attrattr name is a new attribute which does not carry any payload. E.g.
let required = attr "required"val string_attr : string -> ?raw:bool -> _ string_attrstring_attr name fmt is a new string-valued attribute which allows formatting i.e. string interpolation of the value. Note, the fmt argument is required due to the value restriction.
val uri_attr : string -> _ string_attrConvenience for attributes whose values should be URIs. Takes care of URI- encoding.
a [href "/blog?tags=iamsafe\"></a><script>alert('Pwned')</script>"] [txt "Tags: tag1 | tag2"]Output:
<a href="/blog?tags=iamsafe%22%3E%3C/a%3E%3Cscript%3Ealert('Pwned')%3C/script%3E">Tags: tag1 | tag2</a>val bool_attr : string -> bool to_attrval float_attr : string -> float to_attrval int_attr : string -> int to_attrval std_tag : string -> std_tagval void_tag : string -> void_tagval text_tag : string -> ?raw:bool -> _ text_tagBuild a tag which can contain only text.
val txt : ?raw:bool -> ('a, unit, string, node) Stdlib.format4 -> 'aA text node inside the DOM e.g. the 'hi' in <b>hi</b>. Allows string interpolation using the same formatting features as Printf.sprintf:
b [] [txt "Hello, %s!" name]Or without interpolation:
b [] [txt "Bold of you."]HTML-escapes the text value using Dream.html_escape. You can use the ~raw param to bypass escaping:
let user_input = "<script>alert('I like HTML injection')</script>" in
+ unit Dream.promiseType-safe wrapper for Dream.send.
val set_body : Dream.response -> node -> unitType-safe wrapper for Dream.set_body. Sets the body to the given node and sets the Content-Type header to text/html.
val write : Dream.stream -> node -> unit Dream.promiseType-safe wrapper for Dream.write.
type 'a to_attr = 'a -> attrAttributes can be created from typed values.
type 'a string_attr = ('a, unit, string, attr) Stdlib.format4 -> 'aSpecial handling for string-value attributes so they can use format strings i.e. string interpolation.
A 'void element': https://developer.mozilla.org/en-US/docs/Glossary/Void_element with no children.
Tags which can have attributes but can contain only text. The text can be formatted.
val attr : string -> attrattr name is a new attribute which does not carry any payload. E.g.
let required = attr "required"val string_attr : string -> ?raw:bool -> _ string_attrstring_attr name fmt is a new string-valued attribute which allows formatting i.e. string interpolation of the value. Note, the fmt argument is required due to the value restriction.
val uri_attr : string -> _ string_attrConvenience for attributes whose values should be URIs. Takes care of both URI-encoding and attribute escaping, as recommended in https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#common-mistake.
Examples
a [href "/blog?tags=iamsafe\"></a><script>alert('Pwned')</script>"] [txt "Tags: tag1 | tag2"]
+==>
+<a href="/blog?tags=iamsafe%22%3E%3C/a%3E%3Cscript%3Ealert('Pwned')%3C/script%3E">Tags: tag1 | tag2</a>
+
+a [href "/foo?a=1&b=2 3&c=4<5&d=6>5"] [txt "Test"]
+==>
+<a href="/foo?a=1&b=2%203&c=4%3C5&d=6%3E5">Test</a>val bool_attr : string -> bool to_attrval float_attr : string -> float to_attrval int_attr : string -> int to_attrval std_tag : string -> std_tagval void_tag : string -> void_tagval text_tag : string -> ?raw:bool -> _ text_tagBuild a tag which can contain only text.
val txt : ?raw:bool -> ('a, unit, string, node) Stdlib.format4 -> 'aA text node inside the DOM e.g. the 'hi' in <b>hi</b>. Allows string interpolation using the same formatting features as Printf.sprintf:
b [] [txt "Hello, %s!" name]Or without interpolation:
b [] [txt "Bold of you."]HTML-escapes the text value using Dream.html_escape. You can use the ~raw param to bypass escaping:
let user_input = "<script>alert('I like HTML injection')</script>" in
txt ~raw:true "%s" user_inputval comment : string -> nodeA comment that will be embedded in the rendered HTML, i.e. <!-- comment -->. The text is HTML-escaped.
val csrf_tag : Dream.request -> nodeConvenience to add a CSRF token generated by Dream into your form. Type-safe wrapper for Dream.csrf_tag.
form
[action "/foo"]
[csrf_tag req; input [name "bar"]; input [type_ "submit"]]Add an attribute to a tag.
let toast msg = p [id "toast"] [txt "%s" msg]
diff --git a/index.html b/index.html
index c69a939..3c93825 100644
--- a/index.html
+++ b/index.html
@@ -11,7 +11,7 @@
OCaml package documentation
- - dream-html v3.2.0
+ - dream-html v3.2.1