@types/dompurify

Sanitizing HTML strings

This feature allows you to sanitize HTML strings to prevent XSS attacks. The sanitize function removes any malicious code from the input string.

import DOMPurify from 'dompurify';
const cleanHTML = DOMPurify.sanitize('<img src=x onerror=alert(1)//>');

Configuring DOMPurify

This feature allows you to configure DOMPurify to customize the sanitization process, such as specifying which tags are allowed.

import DOMPurify from 'dompurify';
const cleanHTML = DOMPurify.sanitize(dirtyHTML, { ALLOWED_TAGS: ['a', 'p'] });

Hooking into DOMPurify

This feature allows you to add hooks to DOMPurify's sanitization process, enabling you to manipulate nodes or their attributes after sanitization.

import DOMPurify from 'dompurify';
DOMPurify.addHook('afterSanitizeAttributes', (node) => {
  // manipulate node attributes after sanitization
});