STRIP-MARKUP(1)

NAME
strip-markup - Strip HTML markup tags from a string

SYNOPSIS
strip-markup [--help] [--] [string]

DESCRIPTION
strip-markup strips HTML markup tags from an untrusted string, returning only the text content. It is intended to ensure that a string will not be interpreted as HTML markup in isolation.

If a string is provided as an argument, it is used as the input. Otherwise, the string is read from standard input.

HTML character references (such as &amp;, &lt;, &#60;) are decoded to their corresponding characters. This decoding can produce non-printable or otherwise dangerous characters: for example &#0;, &#27;, and &#x202e; decode to NUL, the ESC that begins ANSI escape sequences, and the Unicode right-to-left override respectively. The decoded output can therefore be more dangerous than the input - harmless literal text such as &#x202e; becomes a real control character - and is not safe to print to a terminal as-is.

  Double-strip protection
strip-markup performs two consecutive strip passes over the input. If the second pass further transforms the text, this indicates that the first pass revealed new markup that was hidden inside nested tags (for example, <<b>b>Bold<</b>/b>). In this case, the tool treats the input as malicious and replaces all <, >, and & characters in the first-pass result with underscores (_), so that the neutered text is visible to the user as a warning.

  Scope
strip-markup ensures that its output does not contain HTML tags. It does not escape the output for safe embedding in HTML attributes or other HTML contexts. If the output will be inserted into HTML, the caller is responsible for applying appropriate context-specific escaping.

strip-markup is not a display-safety boundary. It removes markup only; it does not remove control characters, ANSI escape sequences, or non-ASCII / Unicode characters, and (as noted above) it decodes HTML entities, which can introduce such characters. Its output must not be printed to a terminal or shown to a user without further sanitization.

For any string that will be displayed to a user - in a terminal or as HTML content - use sanitize-string(1) instead. It combines strip-markup with stdisplay(1) and forces ASCII output, so control characters, escapes, and Unicode cannot survive. strip-markup is a building block of that pipeline, not a substitute for it.

RETURN VALUES

•   0 Successfully stripped markup and printed the result.

•   1 Usage error.

EXAMPLES
Strip tags from a string argument:

strip-markup '<p>Hello <b>world</b>.</p>'

Output: Hello world.

Strip tags from standard input:

echo '<p>Hello</p>' | strip-markup

Use -- to separate options from positional arguments:

strip-markup -- '--help'

SEE ALSO
sanitize-string(1), stdisplay(1)

AUTHOR
This man page has been written by Patrick Schleizer (adrelanos@whonix.org).