code: public HtmlPolicyBuilder withPostprocessor(HtmlStreamEventProcessor pp) {
      this.postprocessor = HtmlStreamEventProcessor.Processors.compose(
          this.postprocessor, pp);
      return this;
    }
docs: Inserts a post-processor into the pipeline between the policy and the
  output sink.
  Post-processors can insert events into the stream that are not vetted
  by the policy, so they are in the TCB.
  <p>
  Try doing what you want with a pre-processor instead of a post-processor
  but if you're thinking of doing search/replace on a sanitized string, then
  definitely use either a pre or post-processor instead.