The rendering components put HTML you did not write in Razor onto a page: the output of a Markdown processor, a
CMS field or an API response. They live in the Osirion.Blazor.Components namespace of the Osirion.Blazor.Core
package:
@using Osirion.Blazor.Components
Components
| Component | What it renders | Script | Available |
|---|---|---|---|
| HTML renderer | Sanitized HTML in an <article>, with Prism highlighting, line numbers and copy buttons for code blocks |
Only for code blocks | 4.0 |
The folder also holds OsirionReveal, which animates content as it scrolls into view with a small script. It does
not have a page yet.
Sanitizing is the default
Since 4.0, OsirionHtmlRenderer sanitizes its input with the registered IHtmlContentSanitizer, an allow-list
built on HtmlSanitizer. Script, event handler attributes, javascript: and data: URLs, forms, iframes, inline
styles and SVG are removed before the markup reaches the page. The CMS content components (ContentView,
DocumentPage and the others) sanitize the same way, so you only reach for the renderer directly when you hold
HTML outside the CMS.