# sanitize
URL: /patitas/api/sanitize/
Section: api
Description: Composable sanitization policies for Patitas AST.
Provides immutable transform policies for stripping unsafe content before
LLM consumption or web rendering. Policies compose via the | operator.
Example:
>>> from patitas import parse, sanitize
>>> from patitas.sanitize import strip_html, strip_dangerous_urls, llm_safe
>>> doc = parse("# Hello\n\n")
>>> clean = sanitize(doc, policy=llm_safe)
---
> For a complete page index, fetch /patitas/llms.txt.
Open LLM text
(/patitas/api/sanitize/index.txt)
Share with AI
Ask Claude
(https://claude.ai/new?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpatitas%2Fapi%2Fsanitize%2Findex.txt)
Ask ChatGPT
(https://chatgpt.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpatitas%2Fapi%2Fsanitize%2Findex.txt)
Ask Gemini
(https://gemini.google.com/app?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpatitas%2Fapi%2Fsanitize%2Findex.txt)
Ask Copilot
(https://copilot.microsoft.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpatitas%2Fapi%2Fsanitize%2Findex.txt)
Module
#
`sanitize`
Composable sanitization policies for Patitas AST.
Provides immutable transform policies for stripping unsafe content before
LLM consumption or web rendering. Policies compose via the | operator.
Example:
```
>>> from patitas import parse, sanitize
>>> from patitas.sanitize import strip_html, strip_dangerous_urls, llm_safe
>>> doc = parse("# Hello\n\n")
>>> clean = sanitize(doc, policy=llm_safe)
```
1Class12Functions
## Classes
`Policy`
3
▼
Wrapper for Document -> Document transform, supports composition via |.
Wrapper for Document -> Document transform, supports composition via |.
#### Methods
Internal Methods
3
▼
`__init__`
1
▼
`def __init__(self, fn: Callable[[Document], Document]) -> None`
##### Parameters
Name
Type
Description
`fn`
`—`
`__call__`
1
`Document (/patitas/api/nodes/#Document)`
▼
`def __call__(self, doc: Document) -> Document`
##### Parameters
Name
Type
Description
`doc`
`—`
##### Returns
`Document (/patitas/api/nodes/#Document)`
`__or__`
1
`Policy (/patitas/api/sanitize/#Policy)`
▼
Chain policies: (self | other)(doc) applies self then other.
`def __or__(self, other: Policy) -> Policy`
##### Parameters
Name
Type
Description
`other`
`—`
##### Returns
`Policy (/patitas/api/sanitize/#Policy)`
## Functions
`_url_scheme`
1
`str | None`
▼
Extract a URL's scheme, robust to obfuscation; None if scheme-less.
Browsers i…
`def _url_scheme(url: str) -> str | None`
Extract a URL's scheme, robust to obfuscation; None if scheme-less.
Browsers ignore HTML entities and embedded control/whitespace characters
when resolving a URL scheme, so`javascript:`can hide as
`javascript:` or `java script:`. We decode entities and strip
ASCII control/whitespace before reading the scheme so the dangerous-scheme
check cannot be bypassed.
Returns the lowercased scheme (without the trailing colon), or None for
scheme-less URLs (relative paths, fragments, protocol-relative`//`),
which are always safe.
##### Parameters
Name
Type
Description
`url`
`str`
##### Returns
`str | None`
`_is_dangerous_url`
1
`bool`
▼
Check if a URL uses a known-dangerous scheme (after de-obfuscation).
`def _is_dangerous_url(url: str) -> bool`
##### Parameters
Name
Type
Description
`url`
`str`
##### Returns
`bool`
`_scheme_allowed`
2
`bool`
▼
Check if a URL's scheme is allowed.
Scheme-less/relative URLs (``/path``, ``#f…
`def _scheme_allowed(url: str, allowed: frozenset[str]) -> bool`
Check if a URL's scheme is allowed.
Scheme-less/relative URLs (`/path`, `#frag`, `//host`) are always
allowed; only an explicit, disallowed scheme is rejected.
##### Parameters
Name
Type
Description
`url`
`str`
`allowed`
`frozenset[str]`
##### Returns
`bool`
`_strip_html`
1
`Document (/patitas/api/nodes/#Document)`
▼
Remove all HtmlBlock and HtmlInline nodes.
`def _strip_html(doc: Document) -> Document`
##### Parameters
Name
Type
Description
`doc`
`Document (/patitas/api/nodes/#Document)`
##### Returns
`Document (/patitas/api/nodes/#Document)`
`_strip_html_comments`
1
`Document (/patitas/api/nodes/#Document)`
▼
Remove HtmlInline nodes where .html starts with