HTML
The HTML extension: rendered block HTML, hidden comments, and sanitizing.
The html extension renders block-level HTML from the document, such as <div>, <details>, or
<table>, and hides HTML comments.
Setup
Import HtmlExtension and pass it through the editor’s extensions option. Create the mount
element before this code runs:
import { Editor } from "@inksane/core";
import { HtmlExtension } from "@inksane/core/extensions/html";
const editor = new Editor({
element: document.getElementById("editor")!,
extensions: [HtmlExtension],
});BaseKit includes HTML rendering. Use BaseKit({ html: false }) to leave document HTML as source text.
What it adds
- Replaces an
HTMLBlockwith a block widget that contains the cleaned markup. The wrapper gets.inksane-html-blockand, like everyhtmlWidget, theinksane-htmlclass. - Hides the source of the block while the selection is outside it.
- Hides HTML comments entirely.
- Adds the
htmlBlockstate query, soeditor.isActive("htmlBlock")reports whether the selection is inside a block.
Clicking a rendered block moves the cursor into its source so it can be edited. Because a block is a
single widget, the up and down arrow keys would normally skip over it, so the extension binds
ArrowUp and ArrowDown to move into an adjacent HTML block when there is one.
Document HTML is not trusted
The markup is cleaned with sanitizeHtml before it is rendered. That helper drops scripts, event
handlers, and unsafe URLs, and unwraps elements it does not know. Inline HTML at the top level of
a paragraph is not rendered yet.
Styling
[data-inksane-editor-content] {
.inksane-html-block {
padding-block: 16px;
}
.inksane-html-block table {
width: 100%;
border-collapse: collapse;
}
.inksane-html-block th,
.inksane-html-block td {
border: 1px solid #ddd;
padding: 6px 12px;
text-align: left;
}
}sanitizeHtml and escapeHtml are exported from @inksane/core if you build your own HTML
rendering. See write your own extension.