dompurify

What is dompurify?

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML, and SVG. It helps prevent Cross-Site Scripting (XSS) attacks by sanitizing HTML content to ensure it's safe to insert into the DOM. It is written in JavaScript and works in all modern web browsers.

What are dompurify's main functionalities?

Sanitizing HTML strings

This feature allows you to sanitize HTML strings to prevent XSS attacks. The code sample demonstrates how to sanitize a string that contains a potentially malicious script. The result of this code would be a safe string with the malicious parts removed.

DOMPurify.sanitize('<img src=x onerror=alert(1)//>');

Configuring the sanitizer

DOMPurify can be configured to allow certain tags, attributes, or schemes. In the code sample, the sanitizer is configured to allow only 'img' tags and will strip out any other tags, including scripts or event handlers.

DOMPurify.sanitize('<img src=x onerror=alert(1)//>', {ALLOWED_TAGS: ['img']});

Hooking into sanitization

DOMPurify allows you to add hooks that can modify the content during the sanitization process. In the code sample, a hook is added that will be called after the attributes of all nodes have been sanitized, allowing for custom manipulation of the nodes.

DOMPurify.addHook('afterSanitizeAttributes', function(node) { /* manipulate node */ });

Other packages similar to dompurify

sanitize-html

sanitize-html is another HTML sanitizer that can clean up user-generated HTML, preventing XSS attacks. It is similar to DOMPurify but has a different API and set of defaults. It also allows for a high degree of customization in terms of what tags and attributes are allowed.

xss

xss is a package that aims to filter input from users to prevent XSS attacks. It is similar to DOMPurify but includes different options and is more focused on filtering input as opposed to sanitizing existing HTML content.

js-xss

js-xss is a whitelist-based HTML sanitizer. Like DOMPurify, it can prevent XSS attacks by sanitizing HTML content. It provides a different API and allows for customization of the whitelist to control which tags and attributes are considered safe.