Function safeCssClass

src/webview/shared.ts:233–236

(cls: string)

/** Trusted CSS class name(s) — must match [a-zA-Z0-9_-\s] only. */
export function safeCssClass(cls: string): SafeHtml {
  if (!/^[a-zA-Z0-9_\-\s]*$/.test(cls)) return rawHtml('');
  return rawHtml(cls);
}

/** Trusted CSS value — rejects characters that could break out of style attributes. */
export function safeCssValue(val: string): SafeHtml {