# `MishkaCmsCore.Runtime.ContentPreviewScrubber`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/runtime/content_preview_scrubber.ex#L5)

What a content editor preview is drawn through, as an `HtmlSanitizeEx` scrubber: every element
and attribute a component draws — a `button`, a `form`, an `svg`, a `figure`, a `dl` — less what
runs or reaches out.

  * elements removed with what they hold: `script`, `style`, `template`, `noscript`, and the ones
    that load or change another document — `iframe`, `frame`, `frameset`, `object`, `embed`,
    `applet`, `base`, `meta`, `link`;
  * attributes removed: every event attribute (`on…`), every LiveView binding (`phx-…`), and an
    address — `href`, `src`, `srcset`, `action`, `formaction`, `poster`, … — that is not http(s),
    mail, phone or the page's own, or, for a picture's `src`, `srcset` or `poster`, a
    `data:image/…` one (a kit's sample pictures travel as those); a `style` is read through
    `HtmlSanitizeEx.Scrubber.CSS`;
  * comments removed.

A preview is drawn inert, in a shadow root, under the admin's Content Security Policy — so a form
it holds submits nothing, a button presses nothing, and a `style` element would be refused anyway.
`HtmlSanitizeEx.html5/1` keeps only the elements it names, and took a button's own element away and
left its label, a definition list's terms without the list: every setting of those components
changed nothing in the preview.

# `sanitize`

```elixir
@spec sanitize(String.t() | nil) :: String.t()
```

`html` with what a preview may not carry taken out.

---

*Consult [api-reference.md](api-reference.md) for complete listing*