HTML (Semantic Module)

The HTML semantic module validates, sanitizes, and secures raw HTML content before it is stored in your database.

Modern web applications often integrate WYSIWYG rich text editors (such as TinyMCE, Quill, or Tiptap) for content management, marketing emails, or embed widgets. Without rigorous backend sanitization, raw HTML fields represent significant security hazards (Cross-Site Scripting, malicious scripts, and layout breaking). The HTML semantic module inspects incoming markup against an allow list of safe tags, enforces sanitization levels, and blocks unauthorized elements.

Technical Specifications

Attribute	Specification
Scope	`Property` (Applied to a text property)
Data Type	`String`
Default Allowed Tags	Safe semantic text formatting tags (`p`, `b`, `i`, `strong`, `em`, `a`, `ul`, `ol`, `li`, `code`, `div`, `span`)
Default Sanitize Level	`'strict'`
Scripts & Iframes	Blocked by default (`allowScripts: false`, `allowIframes: false`)

Key Capabilities

1. Tag Allow Lists (`allowedTags`)

The Serverless Engine validates all elements present in the submitted markup against the configured allowedTags allow list:

Permitted tags are preserved cleanly.
Unauthorized elements (or dangerous tags like <script>, <object>, or <base>) trigger immediate validation errors, safeguarding your application and its users.

2. Fine-Grained Feature Permissions

You can toggle specific categories of markup depending on whether the field is intended for simple formatted text or advanced media embeds:

allowImages (Default: true): Permits <img> tags.
allowLinks (Default: true): Permits <a> anchor hyperlinks.
allowTables (Default: true): Permits <table>, <tr>, <td>, <th> tabular structures.
allowStyles (Default: false): Controls inline CSS style attributes.
allowIframes (Default: false): Allows video embeds (such as YouTube or Vimeo iframes) when explicitly enabled.
allowForms (Default: false): Restricts <form>, <input>, and button controls.
allowScripts (Default: false): Disallows JavaScript execution vectors.

3. Sanitization Strictness (`sanitizeLevel`)

strict (Default): Deep attribute inspection stripping unknown protocols (e.g. javascript:) and arbitrary inline handlers (e.g. onclick=).
moderate: Allows a broader set of standard presentation attributes while maintaining script and form isolation.
none: Bypasses attribute sanitization (recommended only for trusted administrative templates).

Configuration Options

When configuring the HTML semantic in the Domain Modeler, you can adjust:

Option	Type	Default	Description
`allowedTags`	`string[]`	`['b', 'i', 'em', 'strong', 'a', 'p', ...]`	Allow list of permitted HTML elements.
`sanitizeLevel`	`'strict'` \| `'moderate'` \| `'none'`	`'strict'`	Sanitization strictness level.
`allowImages`	`boolean`	`true`	Permits `<img>` image tags.
`allowLinks`	`boolean`	`true`	Permits `<a>` anchor tags.
`allowTables`	`boolean`	`true`	Permits table elements.
`allowIframes`	`boolean`	`false`	Permits `<iframe>` embed frames.
`allowStyles`	`boolean`	`false`	Permits inline `style="..."` attributes.
`allowForms`	`boolean`	`false`	Permits interactive form elements.
`allowScripts`	`boolean`	`false`	Permits `<script>` tags.

API Lifecycle Examples

1. Storing Valid WYSIWYG HTML Content

A client submits safe formatted markup:

POST /articles
Content-Type: application/json

{
  "title": "Welcome to Our Platform",
  "body": "<p>We are <strong>excited</strong> to launch our new portal. Visit <a href=\"https://apinow.app\">our website</a> to learn more.</p>"
}

Server Response (201 Created):

{
  "data": {
    "id": "art_701",
    "title": "Welcome to Our Platform",
    "body": "<p>We are <strong>excited</strong> to launch our new portal. Visit <a href=\"https://apinow.app\">our website</a> to learn more.</p>"
  }
}

2. Validation Failure (Disallowed Script Element)

A client attempts to submit malicious JavaScript tags:

{
  "body": "<p>Hello</p><script>window.location='https://attacker.example.com'</script>"
}

Server Response (400 Bad Request):

{
  "type": "https://docs.apinow.app/errors/validation",
  "title": "Validation Error",
  "status": 400,
  "code": "E_VALIDATION_ERROR",
  "detail": "The field 'body' contains disallowed HTML tag: script."
}

Validation Rules & Modeling Guidelines

Applicable Property Types: Apply to a String property in the Domain Modeler.
Storage Limits: Because HTML markup includes tags, attributes, and styles, ensure the property’s Maximum Length is left unconstrained or set to an appropriately high limit to prevent truncated markup.