Research
Recent Trends in Malicious Packages Targeting Discord
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
isomorphic-dompurify
Advanced tools
Readme
The library makes it possible to seamlessly use DOMPurify on server and client in the same way. It does nothing by itself except providing an isomorphic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks.
DOMPurify needs a DOM tree to base on, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on the server is not the same as on the client.
This project was born with the idea of encapsulating DOMPurify initialization details and providing an easy way to import the library on both, server and client, for example in Next.js apps.
It was inspired by Isomorphic Unfetch.
isomorphic-dompurify | Node.js | Environment |
---|---|---|
<=0.19.0 | >=12 | Server |
>=0.20.0 | >=14 | Server |
>=1.4.0 | >=16 | Server |
>=1.10.0 | >=18 | Server |
$ npm i isomorphic-dompurify
Please note that DOMPurify library doesn't follow Semantic Versioning, so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.
Import:
import DOMPurify from "isomorphic-dompurify";
Importing the entire module for the client/browser version is recommended.
Sanitize:
const clean = DOMPurify.sanitize(dirtyString);
or with config:
const clean = DOMPurify.sanitize(dirtyString, { USE_PROFILES: { html: true } });
browser
entry point on server, which causes the Window is not defined
issue. #228 #214 https://github.com/vercel/next.js/discussions/58142ReferenceError: TextEncoder is not defined
DOMPurify - Apache 2.0 or MPL 2.0 © 2015 Mario Heiderich
Isomorphic DOMPurify - MIT License © 2020 Konstantin Komelin and contributors
FAQs
Makes it possible to use DOMPurify on server and client in the same way.
We found that isomorphic-dompurify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the popular Discord platform.
Security News
Socket CEO Feross Aboukhadijeh joins a16z partners to discuss how modern, sophisticated supply chain attacks require AI-driven defenses and explore the challenges and solutions in leveraging AI for threat detection early in the development life cycle.
Security News
NIST's new AI Risk Management Framework aims to enhance the security and reliability of generative AI systems and address the unique challenges of malicious AI exploits.