Run any Skill in Manus with one click

bx-jsoup

Stars0

Forks0

UpdatedApril 15, 2026 at 14:10

Use this skill when parsing, querying, or sanitizing HTML in BoxLang with the bx-jsoup module: htmlParse(), htmlClean(), CSS selectors, XSS protection, HTML to JSON/XML conversion, and safe HTML allowlisting.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

ortus-boxlang

ortus-boxlang/skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	bx-jsoup
description	Use this skill when parsing, querying, or sanitizing HTML in BoxLang with the bx-jsoup module: htmlParse(), htmlClean(), CSS selectors, XSS protection, HTML to JSON/XML conversion, and safe HTML allowlisting.

bx-jsoup: HTML Parsing & Sanitization

Installation

install-bx-module bx-jsoup
# CommandBox
box install bx-jsoup

BIFs

BIF	Description
`htmlParse( html )`	Parse HTML into a BoxDocument object for querying
`htmlClean( html, [safelist], [baseUri] )`	Sanitize HTML, removing unsafe tags/attributes

HTML Parsing with `htmlParse()`

// Parse HTML into a document
doc = htmlParse( "<html><head><title>My Page</title></head><body><h1>Hello</h1></body></html>" )

// Access basic properties
title       = doc.title()        // "My Page"
bodyText    = doc.body().text()  // "Hello"
innerHtml   = doc.html()         // inner HTML of body
fullHtml    = doc.outerHtml()    // full document HTML

// CSS selector queries — like jQuery
doc = htmlParse( "<ul><li class='item active'>One</li><li class='item'>Two</li></ul>" )
items   = doc.select( ".item" )           // all elements with class "item"
active  = doc.select( ".item.active" )    // elements with both classes
heading = doc.select( "h1, h2" )          // multiple selectors

// Get by ID
element = doc.getElementById( "main-content" )

// Get by tag
paragraphs = doc.getElementsByTag( "p" )

// Get by attribute
links = doc.getElementsByAttribute( "href" )

// Extract text content (strips all HTML)
plainText = doc.text()

BoxDocument Enhanced Methods

doc = htmlParse( htmlContent )

// Convert document to JSON
jsonStr    = doc.toJSON()           // compact JSON
jsonPretty = doc.toJSON( true )     // pretty-printed

// Convert document to XML
xmlStr   = doc.toXML()              // compact XML
xmlPretty = doc.toXML( true, 2 )   // pretty-printed, 2-space indent

HTML Sanitization with `htmlClean()`

htmlClean() removes tags and attributes not on the allowlist — protecting against XSS:

// Using built-in safelists
// "none"             — strip all HTML
// "simpleText"       — bold, italic, underline only
// "basic"            — basic formatting + links
// "basicWithImages"  — basic + img tags
// "relaxed"          — full formatting, links, images

cleanHtml = htmlClean( userInput, "basic" )

// Example: remove all HTML
plainText = htmlClean( "<script>alert(1)</script><p>Hello</p>", "none" )
// Returns: "Hello"

// Strip scripts but keep basic formatting
safe = htmlClean( "<script>xss()</script><b>Bold</b><p>Text</p>", "basic" )
// Returns: <b>Bold</b><p>Text</p>

// Rewrite relative URLs to absolute
safe = htmlClean( '<a href="/page">Link</a>', "basic", "https://example.com" )
// Returns: <a href="https://example.com/page" rel="nofollow">Link</a>

Common Patterns

// Sanitize user-submitted HTML from a rich text editor
function sanitizeRichText( html ) {
    return htmlClean( html, "basicWithImages" )
}

// Extract all links from a page
function extractLinks( html ) {
    var doc   = htmlParse( html )
    var links = doc.select( "a[href]" )
    return links.map( el => el.attr( "href" ) )
}

// Scrape structured data
function scrapePrices( html ) {
    var doc    = htmlParse( html )
    var prices = doc.select( ".price" )
    return prices.map( el => el.text() )
}

Common Pitfalls

❌ Never output user-supplied HTML without running it through htmlClean() first
✅ Use "basic" or "basicWithImages" for rich text editor output — "relaxed" is rarely safe for user input
✅ htmlParse() is for trusted HTML you want to query; htmlClean() is for untrusted HTML you want to render
❌ doc.select() uses CSS selectors, not XPath — "#id", ".class", "tag", "[attr]" syntax

More from this repository

same repository

boxlang-best-practices

ortus-boxlang/skills

Use this skill when writing, reviewing, or improving BoxLang code to ensure it follows community best practices for naming, structure, scoping, error handling, performance, and maintainability.

2026-05-080

boxlang-deployment

ortus-boxlang/skills

Use this skill when deploying BoxLang applications: CommandBox server setup, Docker containers, AWS Lambda, GitHub Actions CI/CD, BoxLang Version Manager (BVM), boxlang.json runtime config, environment variables, or Spring Boot integration.

2026-04-290

boxlang-docbox

ortus-boxlang/skills

Use this skill when generating API documentation for BoxLang or CFML projects with DocBox, including installation, CLI usage, programmatic configuration, HTML/JSON/UML/CommandBox output strategies, HTML themes, multiple sources, excludes patterns, and creating custom strategies. DocBox reads JavaDoc-style comments from your source code — see the code-documenter skill for annotation conventions.

2026-04-290

boxlang-file-handling

ortus-boxlang/skills

Use this skill when reading, writing, copying, moving, or deleting files and directories in BoxLang: fileRead, fileWrite, fileCopy, fileMove, directoryList, directoryCreate, fileUpload, streaming large files, or processing CSV/JSON files from disk.

2026-04-290

boxlang-functional-programming

ortus-boxlang/skills

Use this skill when working with BoxLang lambdas, closures, arrow functions, higher-order functions, functional array/struct pipelines (map, filter, reduce, flatMap, groupBy, etc.), destructuring, or spread syntax.

2026-04-290

boxlang-interceptors

ortus-boxlang/skills

Use this skill when working with BoxLang's interceptor/event system: creating interceptors, registering announcement points, announcing custom events with announce() or announceAsync(), building pre/post operation hooks, validation interceptors, security guards, or leveraging BoxRegisterInterceptor() BIF for standalone and module-based interception.

2026-04-290

name	bx-jsoup
description	Use this skill when parsing, querying, or sanitizing HTML in BoxLang with the bx-jsoup module: htmlParse(), htmlClean(), CSS selectors, XSS protection, HTML to JSON/XML conversion, and safe HTML allowlisting.

bx-jsoup: HTML Parsing & Sanitization

Installation

install-bx-module bx-jsoup
# CommandBox
box install bx-jsoup

BIFs

BIF	Description
`htmlParse( html )`	Parse HTML into a BoxDocument object for querying
`htmlClean( html, [safelist], [baseUri] )`	Sanitize HTML, removing unsafe tags/attributes

HTML Parsing with `htmlParse()`

// Parse HTML into a document
doc = htmlParse( "<html><head><title>My Page</title></head><body><h1>Hello</h1></body></html>" )

// Access basic properties
title       = doc.title()        // "My Page"
bodyText    = doc.body().text()  // "Hello"
innerHtml   = doc.html()         // inner HTML of body
fullHtml    = doc.outerHtml()    // full document HTML

// CSS selector queries — like jQuery
doc = htmlParse( "<ul><li class='item active'>One</li><li class='item'>Two</li></ul>" )
items   = doc.select( ".item" )           // all elements with class "item"
active  = doc.select( ".item.active" )    // elements with both classes
heading = doc.select( "h1, h2" )          // multiple selectors

// Get by ID
element = doc.getElementById( "main-content" )

// Get by tag
paragraphs = doc.getElementsByTag( "p" )

// Get by attribute
links = doc.getElementsByAttribute( "href" )

// Extract text content (strips all HTML)
plainText = doc.text()

BoxDocument Enhanced Methods

doc = htmlParse( htmlContent )

// Convert document to JSON
jsonStr    = doc.toJSON()           // compact JSON
jsonPretty = doc.toJSON( true )     // pretty-printed

// Convert document to XML
xmlStr   = doc.toXML()              // compact XML
xmlPretty = doc.toXML( true, 2 )   // pretty-printed, 2-space indent

HTML Sanitization with `htmlClean()`

htmlClean() removes tags and attributes not on the allowlist — protecting against XSS:

// Using built-in safelists
// "none"             — strip all HTML
// "simpleText"       — bold, italic, underline only
// "basic"            — basic formatting + links
// "basicWithImages"  — basic + img tags
// "relaxed"          — full formatting, links, images

cleanHtml = htmlClean( userInput, "basic" )

// Example: remove all HTML
plainText = htmlClean( "<script>alert(1)</script><p>Hello</p>", "none" )
// Returns: "Hello"

// Strip scripts but keep basic formatting
safe = htmlClean( "<script>xss()</script><b>Bold</b><p>Text</p>", "basic" )
// Returns: <b>Bold</b><p>Text</p>

// Rewrite relative URLs to absolute
safe = htmlClean( '<a href="/page">Link</a>', "basic", "https://example.com" )
// Returns: <a href="https://example.com/page" rel="nofollow">Link</a>

Common Patterns

// Sanitize user-submitted HTML from a rich text editor
function sanitizeRichText( html ) {
    return htmlClean( html, "basicWithImages" )
}

// Extract all links from a page
function extractLinks( html ) {
    var doc   = htmlParse( html )
    var links = doc.select( "a[href]" )
    return links.map( el => el.attr( "href" ) )
}

// Scrape structured data
function scrapePrices( html ) {
    var doc    = htmlParse( html )
    var prices = doc.select( ".price" )
    return prices.map( el => el.text() )
}

Common Pitfalls

❌ Never output user-supplied HTML without running it through htmlClean() first
✅ Use "basic" or "basicWithImages" for rich text editor output — "relaxed" is rarely safe for user input
✅ htmlParse() is for trusted HTML you want to query; htmlClean() is for untrusted HTML you want to render
❌ doc.select() uses CSS selectors, not XPath — "#id", ".class", "tag", "[attr]" syntax

bx-jsoup

bx-jsoup: HTML Parsing & Sanitization

Installation

BIFs

HTML Parsing with htmlParse()

BoxDocument Enhanced Methods

HTML Sanitization with htmlClean()

Common Patterns

Common Pitfalls

More from this repository

More from this repository

bx-jsoup: HTML Parsing & Sanitization

Installation

BIFs

HTML Parsing with htmlParse()

BoxDocument Enhanced Methods

HTML Sanitization with htmlClean()

Common Patterns

Common Pitfalls

HTML Parsing with `htmlParse()`

HTML Sanitization with `htmlClean()`

HTML Parsing with `htmlParse()`

HTML Sanitization with `htmlClean()`