Security considerations for GoMoji
mainWhen using GoMoji, keep the following security and technical constraints in mind:
- Not a Sanitizer: GoMoji is a string-processing library, not a security sanitizer. Do not use it to prevent XSS or injection attacks; use a dedicated HTML/markup sanitizer for that.
- Grapheme Clusters: Detection and replacement operate on Unicode grapheme clusters. Do not assume that one code point equals one visible symbol.
- Variation Selectors: Variation selectors are stripped during processing to normalize output. If your application requires preserving exact variation selectors, avoid using
RemoveEmojisorReplace*methods. - Untrusted Output: When using
ReplaceEmojisWithSlug, treat the resulting string as untrusted user-controlled input and escape/encode it appropriately for your output context.