bx-jsoup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bx-jsoup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
install-bx-module bx-jsoup
# CommandBox
box install bx-jsoup| BIF | Description |
|---|---|
htmlParse( html ) | Parse HTML into a BoxDocument object for querying |
htmlClean( html, [safelist], [baseUri] ) | Sanitize HTML, removing unsafe tags/attributes |
htmlParse()// Parse HTML into a document
doc = htmlParse( "<html><head><title>My Page</title></head><body><h1>Hello</h1></body></html>" )
// Access basic properties
title = doc.title() // "My Page"
bodyText = doc.body().text() // "Hello"
innerHtml = doc.html() // inner HTML of body
fullHtml = doc.outerHtml() // full document HTML
// CSS selector queries — like jQuery
doc = htmlParse( "<ul><li class='item active'>One</li><li class='item'>Two</li></ul>" )
items = doc.select( ".item" ) // all elements with class "item"
active = doc.select( ".item.active" ) // elements with both classes
heading = doc.select( "h1, h2" ) // multiple selectors
// Get by ID
element = doc.getElementById( "main-content" )
// Get by tag
paragraphs = doc.getElementsByTag( "p" )
// Get by attribute
links = doc.getElementsByAttribute( "href" )
// Extract text content (strips all HTML)
plainText = doc.text()doc = htmlParse( htmlContent )
// Convert document to JSON
jsonStr = doc.toJSON() // compact JSON
jsonPretty = doc.toJSON( true ) // pretty-printed
// Convert document to XML
xmlStr = doc.toXML() // compact XML
xmlPretty = doc.toXML( true, 2 ) // pretty-printed, 2-space indenthtmlClean()htmlClean() removes tags and attributes not on the allowlist — protecting against XSS:
// Using built-in safelists
// "none" — strip all HTML
// "simpleText" — bold, italic, underline only
// "basic" — basic formatting + links
// "basicWithImages" — basic + img tags
// "relaxed" — full formatting, links, images
cleanHtml = htmlClean( userInput, "basic" )
// Example: remove all HTML
plainText = htmlClean( "<script>alert(1)</script><p>Hello</p>", "none" )
// Returns: "Hello"
// Strip scripts but keep basic formatting
safe = htmlClean( "<script>xss()</script><b>Bold</b><p>Text</p>", "basic" )
// Returns: <b>Bold</b><p>Text</p>
// Rewrite relative URLs to absolute
safe = htmlClean( '<a href="/page">Link</a>', "basic", "https://example.com" )
// Returns: <a href="https://example.com/page" rel="nofollow">Link</a>// Sanitize user-submitted HTML from a rich text editor
function sanitizeRichText( html ) {
return htmlClean( html, "basicWithImages" )
}
// Extract all links from a page
function extractLinks( html ) {
var doc = htmlParse( html )
var links = doc.select( "a[href]" )
return links.map( el => el.attr( "href" ) )
}
// Scrape structured data
function scrapePrices( html ) {
var doc = htmlParse( html )
var prices = doc.select( ".price" )
return prices.map( el => el.text() )
}htmlClean() first"basic" or "basicWithImages" for rich text editor output — "relaxed" is rarely safe for user inputhtmlParse() is for trusted HTML you want to query; htmlClean() is for untrusted HTML you want to renderdoc.select() uses CSS selectors, not XPath — "#id", ".class", "tag", "[attr]" syntax~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.