strip-markup(1) -- Strip HTML markup tags from a string
========================================================

<!--
# Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
# See the file COPYING for copying conditions.
-->

## SYNOPSIS

`strip-markup [--help] [--] [string]`

## DESCRIPTION

`strip-markup` strips HTML markup tags from an untrusted string,
returning only the text content. It is intended to ensure that a string
will not be interpreted as HTML markup in isolation.

If a string is provided as an argument, it is used as the input.
Otherwise, the string is read from standard input.

HTML character references (such as `&amp;`, `&lt;`, `&#60;`) are
decoded to their corresponding characters. This decoding can produce
non-printable or otherwise dangerous characters: for example `&#0;`,
`&#27;`, and `&#x202e;` decode to NUL, the ESC that begins ANSI escape
sequences, and the Unicode right-to-left override respectively. The
decoded output can therefore be **more dangerous than the input** -
harmless literal text such as `&#x202e;` becomes a real control
character - and is not safe to print to a terminal as-is.

### Double-strip protection

`strip-markup` performs two consecutive strip passes over the input. If
the second pass further transforms the text, this indicates that the
first pass revealed new markup that was hidden inside nested tags (for
example, `<<b>b>Bold<</b>/b>`). In this case, the tool treats the
input as malicious and replaces all `<`, `>`, and `&` characters in the
first-pass result with underscores (`_`), so that the neutered text is
visible to the user as a warning.

### Scope

`strip-markup` ensures that its output does not contain HTML tags. It
does **not** escape the output for safe embedding in HTML attributes or
other HTML contexts. If the output will be inserted into HTML, the
caller is responsible for applying appropriate context-specific
escaping.

`strip-markup` is **not** a display-safety boundary. It removes markup
only; it does not remove control characters, ANSI escape sequences, or
non-ASCII / Unicode characters, and (as noted above) it decodes HTML
entities, which can introduce such characters. Its output must not be
printed to a terminal or shown to a user without further sanitization.

For any string that will be displayed to a user - in a terminal or as
HTML content - use `sanitize-string`(1) instead. It combines
`strip-markup` with `stdisplay`(1) and forces ASCII output, so control
characters, escapes, and Unicode cannot survive. `strip-markup` is a
building block of that pipeline, not a substitute for it.

## RETURN VALUES

* `0` Successfully stripped markup and printed the result.
* `1` Usage error.

## EXAMPLES

Strip tags from a string argument:

<code>
strip-markup '&lt;p&gt;Hello &lt;b&gt;world&lt;/b&gt;.&lt;/p&gt;'
</code>

Output: `Hello world.`

Strip tags from standard input:

<code>
echo '&lt;p&gt;Hello&lt;/p&gt;' | strip-markup
</code>

Use `--` to separate options from positional arguments:

<code>
strip-markup -- '--help'
</code>

## SEE ALSO

sanitize-string(1), stdisplay(1)

## AUTHOR

This man page has been written by Patrick Schleizer (adrelanos@whonix.org).
