# `Leaf.Sanitizer`
[🔗](https://github.com/alexdont/leaf/blob/main/lib/leaf/sanitizer.ex#L1)

The allow-list rendered markdown passes before it reaches a page.

Markdown may carry raw HTML, and Leaf writes some itself (figures, details,
sized images), so the renderer runs with `unsafe: true` — which would also
let through a `<script>`, an `onerror` or a `javascript:` link typed by
whoever wrote the document; with live editing that is a collaborator's
browser. Everything Leaf emits is on the list, nothing that runs code is.

A host rendering the saved markdown itself can reuse the same list:

    MDEx.to_html!(markdown, render: [unsafe: true], sanitize: Leaf.Sanitizer.options())

# `options`

```elixir
@spec options() :: keyword()
```

MDEx's `sanitize:` option, extended with the tags, attributes and URL
schemes Leaf's own markup uses.

---

*Consult [api-reference.md](api-reference.md) for complete listing*