Safe rendering & application boundaries
A coherent working example of the framework's rendering and integration contracts.
Text escaping & safe Markdown
Try HTML-sensitive input. Paragraph escapes text; Markdown escapes raw HTML and sanitizes unsafe links. RawHtml is a deliberately trusted boundary, not a sanitizer.
Escaped text
<strong>Plain text</strong>
Safe Markdown
<strong>Plain text</strong>
public static String safe(String value) {
return new Div().withId("safe-result").withAttribute("aria-live", "polite")
.withChild(Header.H3("Escaped text")).withChild(new Paragraph(value))
.withChild(Header.H3("Safe Markdown")).withChild(new Markdown(value)).render();
}
public static String safetyPreview() {
Form form = Form.create().withAction("/demos/api/safe").withMethod(Form.Method.POST)
.withHxPost("/demos/api/safe").withHxTarget("#safe-result").withHxSwap("outerHTML")
.addField("Untrusted text", TextInput.create("value").withValue("<script>alert('not executed')</script>").required())
.withChild(Button.submit("Render safely"));
return new Div().withChild(form).withChild(new RawHtml(safe("<strong>Plain text</strong>"))).render();
}
// POST /demos/api/safe returns safe(value). RawHtml above wraps framework-rendered HTML only.
URL & style validation
These are actual rejected configuration attempts. Validation is not endpoint authorization, destination policy or CSRF enforcement.
Rejected javascript: link: javascript URLs are not allowed for security reasons. Allowed schemes: http, https, mailto, tel, or relative paths.
Rejected injected style: Invalid CSS value: declaration breakout is not allowed
public static String rejectedUrl() {
try { SafeUrl.validateHref("javascript:alert(1)"); return "URL accepted"; }
catch (IllegalArgumentException rejected) { return "Rejected javascript: link: " + rejected.getMessage(); }
}
public static String rejectedStyle() {
try { new Div().addStyle("color", "red;display:none"); return "Style accepted"; }
catch (IllegalArgumentException rejected) { return "Rejected injected style: " + rejected.getMessage(); }
}
public static String rejectedPreview() {
return new Div().withChild(new Paragraph(rejectedUrl())).withChild(new Paragraph(rejectedStyle())).render();
}
Style & class composition
Style is a raw application-owned fragment builder, not a CSS sanitizer. CssClassNames combines class tokens.
Style style = Style.create().padding("1rem").color("#245C48");
HtmlTag styled = new Div().withInnerText("Application-owned style values");
styled.withAttribute("style", style.getStyleString());
CssClassNames.addTokens(styled, "example-style", "example-style");
styled.render();AuthWrapper: simulated policy
Toggle the simulated check. This demonstrates action gating, not login or real authorization.
Reviewer mode: USER_EDIT
Reviewer may delete: false
Owner may delete: false
public static AuthorizationChecker policy(boolean allow) {
return new AuthorizationChecker() {
public boolean canEdit(String moduleId, String userId) { return allow && "specimen".equals(moduleId) && "reviewer".equals(userId); }
public boolean canDelete(String moduleId, String userId) { return allow && "specimen".equals(moduleId) && "owner".equals(userId); }
public EditMode getEditMode(String moduleId, String userId) {
return canDelete(moduleId, userId) ? EditMode.OWNER_EDIT : EditMode.USER_EDIT;
}
};
}
public static String auth(boolean allow) {
AuthorizationChecker checker = policy(allow);
return new Div().withId("auth-result").withAttribute("role", "status")
.withChild(new RawHtml(AuthWrapper.require(() -> checker.canEdit("specimen", "reviewer"),
() -> Alert.success("Simulated action allowed").render(), () -> Alert.warning("Simulated action denied").render())))
.withChild(new Paragraph("Reviewer mode: " + checker.getEditMode("specimen", "reviewer")))
.withChild(new Paragraph("Reviewer may delete: " + checker.canDelete("specimen", "reviewer")))
.withChild(new Paragraph("Owner may delete: " + checker.canDelete("specimen", "owner"))).render();
}
public static String authPreview() {
return new Div().withChild(Form.create().withAction("/demos/api/auth").withMethod(Form.Method.POST)
.withHxPost("/demos/api/auth").withHxTarget("#auth-result").withHxSwap("outerHTML")
.withChild(Checkbox.create("allow", "true").withLabel("Simulate permission granted"))
.withChild(Button.submit("Evaluate policy"))).withChild(new RawHtml(auth(false))).render();
}
// The checkbox POSTs allow to /demos/api/auth; the response replaces #auth-result.