菜单
Use this skill when parsing, querying, or sanitizing HTML in BoxLang with the bx-jsoup module: htmlParse(), htmlClean(), CSS selectors, XSS protection, HTML to JSON/XML conversion, and safe HTML allowlisting.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when writing, reviewing, or improving BoxLang code to ensure it follows community best practices for naming, structure, scoping, error handling, performance, and maintainability.
Use this skill when deploying BoxLang applications: CommandBox server setup, Docker containers, AWS Lambda, GitHub Actions CI/CD, BoxLang Version Manager (BVM), boxlang.json runtime config, environment variables, or Spring Boot integration.
Use this skill when generating API documentation for BoxLang or CFML projects with DocBox, including installation, CLI usage, programmatic configuration, HTML/JSON/UML/CommandBox output strategies, HTML themes, multiple sources, excludes patterns, and creating custom strategies. DocBox reads JavaDoc-style comments from your source code — see the code-documenter skill for annotation conventions.
Use this skill when reading, writing, copying, moving, or deleting files and directories in BoxLang: fileRead, fileWrite, fileCopy, fileMove, directoryList, directoryCreate, fileUpload, streaming large files, or processing CSV/JSON files from disk.
Use this skill when working with BoxLang lambdas, closures, arrow functions, higher-order functions, functional array/struct pipelines (map, filter, reduce, flatMap, groupBy, etc.), destructuring, or spread syntax.
Use this skill when working with BoxLang's interceptor/event system: creating interceptors, registering announcement points, announcing custom events with announce() or announceAsync(), building pre/post operation hooks, validation interceptors, security guards, or leveraging BoxRegisterInterceptor() BIF for standalone and module-based interception.
| name | bx-jsoup |
| description | Use this skill when parsing, querying, or sanitizing HTML in BoxLang with the bx-jsoup module: htmlParse(), htmlClean(), CSS selectors, XSS protection, HTML to JSON/XML conversion, and safe HTML allowlisting. |
install-bx-module bx-jsoup
# CommandBox
box install bx-jsoup
| BIF | Description |
|---|---|
htmlParse( html ) | Parse HTML into a BoxDocument object for querying |
htmlClean( html, [safelist], [baseUri] ) | Sanitize HTML, removing unsafe tags/attributes |
htmlParse()// Parse HTML into a document
doc = htmlParse( "<html><head><title>My Page</title></head><body><h1>Hello</h1></body></html>" )
// Access basic properties
title = doc.title() // "My Page"
bodyText = doc.body().text() // "Hello"
innerHtml = doc.html() // inner HTML of body
fullHtml = doc.outerHtml() // full document HTML
// CSS selector queries — like jQuery
doc = htmlParse( "<ul><li class='item active'>One</li><li class='item'>Two</li></ul>" )
items = doc.select( ".item" ) // all elements with class "item"
active = doc.select( ".item.active" ) // elements with both classes
heading = doc.select( "h1, h2" ) // multiple selectors
// Get by ID
element = doc.getElementById( "main-content" )
// Get by tag
paragraphs = doc.getElementsByTag( "p" )
// Get by attribute
links = doc.getElementsByAttribute( "href" )
// Extract text content (strips all HTML)
plainText = doc.text()
doc = htmlParse( htmlContent )
// Convert document to JSON
jsonStr = doc.toJSON() // compact JSON
jsonPretty = doc.toJSON( true ) // pretty-printed
// Convert document to XML
xmlStr = doc.toXML() // compact XML
xmlPretty = doc.toXML( true, 2 ) // pretty-printed, 2-space indent
htmlClean()htmlClean() removes tags and attributes not on the allowlist — protecting against XSS:
// Using built-in safelists
// "none" — strip all HTML
// "simpleText" — bold, italic, underline only
// "basic" — basic formatting + links
// "basicWithImages" — basic + img tags
// "relaxed" — full formatting, links, images
cleanHtml = htmlClean( userInput, "basic" )
// Example: remove all HTML
plainText = htmlClean( "<script>alert(1)</script><p>Hello</p>", "none" )
// Returns: "Hello"
// Strip scripts but keep basic formatting
safe = htmlClean( "<script>xss()</script><b>Bold</b><p>Text</p>", "basic" )
// Returns: <b>Bold</b><p>Text</p>
// Rewrite relative URLs to absolute
safe = htmlClean( '<a href="/page">Link</a>', "basic", "https://example.com" )
// Returns: <a href="https://example.com/page" rel="nofollow">Link</a>
// Sanitize user-submitted HTML from a rich text editor
function sanitizeRichText( html ) {
return htmlClean( html, "basicWithImages" )
}
// Extract all links from a page
function extractLinks( html ) {
var doc = htmlParse( html )
var links = doc.select( "a[href]" )
return links.map( el => el.attr( "href" ) )
}
// Scrape structured data
function scrapePrices( html ) {
var doc = htmlParse( html )
var prices = doc.select( ".price" )
return prices.map( el => el.text() )
}
htmlClean() first"basic" or "basicWithImages" for rich text editor output — "relaxed" is rarely safe for user inputhtmlParse() is for trusted HTML you want to query; htmlClean() is for untrusted HTML you want to renderdoc.select() uses CSS selectors, not XPath — "#id", ".class", "tag", "[attr]" syntax